[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M715F8THBTKAF8X0XC4C0WE6":3,"skill-same:01M715F8THBTKAF8X0XC4C0WE6":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":14,"repositoryHtmlUrl":48,"repositoryHomepageUrl":6,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M715F8THBTKAF8X0XC4C0WE6","azure-security-keyvault-keys-dotnet",null,"Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fazure-security-keyvault-keys-dotnet\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"dotnet","azure","azure security keyvault keys dotnet","security","keys","azure security","2026","managed","unknown","for","rotation","creation","azure key vault","community","use","decryption","hsm","encryption","library","verification","2026-11-10 10:12:30",false,"---\nname: azure-security-keyvault-keys-dotnet\ndescription: Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification.\nrisk: unknown\nsource: community\ndate_added: '2026-02-27'\n---\n\n# Azure.Security.KeyVault.Keys (.NET)\n\nClient library for managing cryptographic keys in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```bash\ndotnet add package Azure.Security.KeyVault.Keys\ndotnet add package Azure.Identity\n```\n\n**Current Version**: 4.7.0 (stable)\n\n## Environment Variables\n\n```bash\nKEY_VAULT_NAME=\u003Cyour-key-vault-name>\n# Or full URI\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Client Hierarchy\n\n```\nKeyClient (key management)\n├── CreateKey \u002F CreateRsaKey \u002F CreateEcKey\n├── GetKey \u002F GetKeys\n├── UpdateKeyProperties\n├── DeleteKey \u002F PurgeDeletedKey\n├── BackupKey \u002F RestoreKey\n└── GetCryptographyClient() → CryptographyClient\n\nCryptographyClient (cryptographic operations)\n├── Encrypt \u002F Decrypt\n├── WrapKey \u002F UnwrapKey\n├── Sign \u002F Verify\n└── SignData \u002F VerifyData\n\nKeyResolver (key resolution)\n└── Resolve(keyId) → CryptographyClient\n```\n\n## Authentication\n\n### DefaultAzureCredential (Recommended)\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Keys;\n\nvar keyVaultName = Environment.GetEnvironmentVariable(\"KEY_VAULT_NAME\");\nvar kvUri = $\"https:\u002F\u002F{keyVaultName}.vault.azure.net\";\n\nvar client = new KeyClient(new Uri(kvUri), new DefaultAzureCredential());\n```\n\n### Service Principal\n\n```csharp\nvar credential = new ClientSecretCredential(\n    tenantId: \"\u003Ctenant-id>\",\n    clientId: \"\u003Cclient-id>\",\n    clientSecret: \"\u003Cclient-secret>\");\n\nvar client = new KeyClient(new Uri(kvUri), credential);\n```\n\n## Key Management\n\n### Create Keys\n\n```csharp\n\u002F\u002F Create RSA key\nKeyVaultKey rsaKey = await client.CreateKeyAsync(\"my-rsa-key\", KeyType.Rsa);\nConsole.WriteLine($\"Created key: {rsaKey.Name}, Type: {rsaKey.KeyType}\");\n\n\u002F\u002F Create RSA key with options\nvar rsaOptions = new CreateRsaKeyOptions(\"my-rsa-key-2048\")\n{\n    KeySize = 2048,\n    HardwareProtected = false, \u002F\u002F true for HSM-backed\n    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),\n    NotBefore = DateTimeOffset.UtcNow,\n    Enabled = true\n};\nrsaOptions.KeyOperations.Add(KeyOperation.Encrypt);\nrsaOptions.KeyOperations.Add(KeyOperation.Decrypt);\n\nKeyVaultKey rsaKey2 = await client.CreateRsaKeyAsync(rsaOptions);\n\n\u002F\u002F Create EC key\nvar ecOptions = new CreateEcKeyOptions(\"my-ec-key\")\n{\n    CurveName = KeyCurveName.P256,\n    HardwareProtected = true \u002F\u002F HSM-backed\n};\nKeyVaultKey ecKey = await client.CreateEcKeyAsync(ecOptions);\n\n\u002F\u002F Create Oct (symmetric) key for wrap\u002Funwrap\nvar octOptions = new CreateOctKeyOptions(\"my-oct-key\")\n{\n    KeySize = 256,\n    HardwareProtected = true\n};\nKeyVaultKey octKey = await client.CreateOctKeyAsync(octOptions);\n```\n\n### Retrieve Keys\n\n```csharp\n\u002F\u002F Get specific key (latest version)\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"Key ID: {key.Id}\");\nConsole.WriteLine($\"Key Type: {key.KeyType}\");\nConsole.WriteLine($\"Version: {key.Properties.Version}\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = await client.GetKeyAsync(\"my-rsa-key\", \"version-id\");\n\n\u002F\u002F List all keys\nawait foreach (KeyProperties keyProps in client.GetPropertiesOfKeysAsync())\n{\n    Console.WriteLine($\"Key: {keyProps.Name}, Enabled: {keyProps.Enabled}\");\n}\n\n\u002F\u002F List key versions\nawait foreach (KeyProperties version in client.GetPropertiesOfKeyVersionsAsync(\"my-rsa-key\"))\n{\n    Console.WriteLine($\"Version: {version.Version}, Created: {version.CreatedOn}\");\n}\n```\n\n### Update Key Properties\n\n```csharp\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\n\nkey.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddYears(2);\nkey.Properties.Tags[\"environment\"] = \"production\";\n\nKeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(key.Properties);\n```\n\n### Delete and Purge Keys\n\n```csharp\n\u002F\u002F Start delete operation\nDeleteKeyOperation operation = await client.StartDeleteKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Wait for deletion to complete (required before purge)\nawait operation.WaitForCompletionAsync();\nConsole.WriteLine($\"Deleted key scheduled purge date: {operation.Value.ScheduledPurgeDate}\");\n\n\u002F\u002F Purge immediately (if soft-delete is enabled)\nawait client.PurgeDeletedKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Or recover deleted key\nKeyVaultKey recoveredKey = await client.StartRecoverDeletedKeyAsync(\"my-rsa-key\");\n```\n\n### Backup and Restore\n\n```csharp\n\u002F\u002F Backup key\nbyte[] backup = await client.BackupKeyAsync(\"my-rsa-key\");\nawait File.WriteAllBytesAsync(\"key-backup.bin\", backup);\n\n\u002F\u002F Restore key\nbyte[] backupData = await File.ReadAllBytesAsync(\"key-backup.bin\");\nKeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(backupData);\n```\n\n## Cryptographic Operations\n\n### Get CryptographyClient\n\n```csharp\n\u002F\u002F From KeyClient\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nCryptographyClient cryptoClient = client.GetCryptographyClient(\n    key.Name, \n    key.Properties.Version);\n\n\u002F\u002F Or create directly with key ID\nCryptographyClient cryptoClient = new CryptographyClient(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-rsa-key\u002Fversion\"),\n    new DefaultAzureCredential());\n```\n\n### Encrypt and Decrypt\n\n```csharp\nbyte[] plaintext = Encoding.UTF8.GetBytes(\"Secret message to encrypt\");\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\nConsole.WriteLine($\"Encrypted: {Convert.ToBase64String(encryptResult.Ciphertext)}\");\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = await cryptoClient.DecryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    encryptResult.Ciphertext);\nstring decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);\nConsole.WriteLine($\"Decrypted: {decrypted}\");\n```\n\n### Wrap and Unwrap Keys\n\n```csharp\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32]; \u002F\u002F 256-bit key\nRandomNumberGenerator.Fill(keyToWrap);\n\n\u002F\u002F Wrap key\nWrapResult wrapResult = await cryptoClient.WrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    keyToWrap);\n\n\u002F\u002F Unwrap key\nUnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    wrapResult.EncryptedKey);\n```\n\n### Sign and Verify\n\n```csharp\n\u002F\u002F Data to sign\nbyte[] data = Encoding.UTF8.GetBytes(\"Data to sign\");\n\n\u002F\u002F Sign data (computes hash internally)\nSignResult signResult = await cryptoClient.SignDataAsync(\n    SignatureAlgorithm.RS256, \n    data);\n\n\u002F\u002F Verify signature\nVerifyResult verifyResult = await cryptoClient.VerifyDataAsync(\n    SignatureAlgorithm.RS256, \n    data, \n    signResult.Signature);\nConsole.WriteLine($\"Signature valid: {verifyResult.IsValid}\");\n\n\u002F\u002F Or sign pre-computed hash\nusing var sha256 = SHA256.Create();\nbyte[] hash = sha256.ComputeHash(data);\n\nSignResult signHashResult = await cryptoClient.SignAsync(\n    SignatureAlgorithm.RS256, \n    hash);\n```\n\n## Key Resolver\n\n```csharp\nusing Azure.Security.KeyVault.Keys.Cryptography;\n\nvar resolver = new KeyResolver(new DefaultAzureCredential());\n\n\u002F\u002F Resolve key by ID to get CryptographyClient\nCryptographyClient cryptoClient = await resolver.ResolveAsync(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-key\u002Fversion\"));\n\n\u002F\u002F Use for encryption\nEncryptResult result = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\n```\n\n## Key Rotation\n\n```csharp\n\u002F\u002F Rotate key (creates new version)\nKeyVaultKey rotatedKey = await client.RotateKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"New version: {rotatedKey.Properties.Version}\");\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy policy = await client.GetKeyRotationPolicyAsync(\"my-rsa-key\");\n\n\u002F\u002F Update rotation policy\npolicy.ExpiresIn = \"P90D\"; \u002F\u002F 90 days\npolicy.LifetimeActions.Add(new KeyRotationLifetimeAction\n{\n    Action = KeyRotationPolicyAction.Rotate,\n    TimeBeforeExpiry = \"P30D\" \u002F\u002F Rotate 30 days before expiry\n});\n\nawait client.UpdateKeyRotationPolicyAsync(\"my-rsa-key\", policy);\n```\n\n## Key Types Reference\n\n| Type | Purpose |\n|------|---------|\n| `KeyClient` | Key management operations |\n| `CryptographyClient` | Cryptographic operations |\n| `KeyResolver` | Resolve key ID to CryptographyClient |\n| `KeyVaultKey` | Key with cryptographic material |\n| `KeyProperties` | Key metadata (no crypto material) |\n| `CreateRsaKeyOptions` | RSA key creation options |\n| `CreateEcKeyOptions` | EC key creation options |\n| `CreateOctKeyOptions` | Symmetric key options |\n| `EncryptResult` | Encryption result |\n| `DecryptResult` | Decryption result |\n| `SignResult` | Signing result |\n| `VerifyResult` | Verification result |\n| `WrapResult` | Key wrap result |\n| `UnwrapResult` | Key unwrap result |\n\n## Algorithms Reference\n\n### Encryption Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `Rsa15` | RSA | RSA 1.5 (legacy) |\n| `A128Gcm` | Oct | AES-128-GCM |\n| `A256Gcm` | Oct | AES-256-GCM |\n\n### Signature Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RS256` | RSA | RSASSA-PKCS1-v1_5 SHA-256 |\n| `RS384` | RSA | RSASSA-PKCS1-v1_5 SHA-384 |\n| `RS512` | RSA | RSASSA-PKCS1-v1_5 SHA-512 |\n| `PS256` | RSA | RSASSA-PSS SHA-256 |\n| `ES256` | EC | ECDSA P-256 SHA-256 |\n| `ES384` | EC | ECDSA P-384 SHA-384 |\n| `ES512` | EC | ECDSA P-521 SHA-512 |\n\n### Key Wrap Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `A128KW` | Oct | AES-128 Key Wrap |\n| `A256KW` | Oct | AES-256 Key Wrap |\n\n## Best Practices\n\n1. **Use Managed Identity** — Prefer `DefaultAzureCredential` over secrets\n2. **Enable soft-delete** — Protect against accidental deletion\n3. **Use HSM-backed keys** — Set `HardwareProtected = true` for sensitive keys\n4. **Implement key rotation** — Use automatic rotation policies\n5. **Limit key operations** — Only enable required `KeyOperations`\n6. **Set expiration dates** — Always set `ExpiresOn` for keys\n7. **Use specific versions** — Pin to versions in production\n8. **Cache CryptographyClient** — Reuse for multiple operations\n\n## Error Handling\n\n```csharp\nusing Azure;\n\ntry\n{\n    KeyVaultKey key = await client.GetKeyAsync(\"my-key\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 404)\n{\n    Console.WriteLine(\"Key not found\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 403)\n{\n    Console.WriteLine(\"Access denied - check RBAC permissions\");\n}\ncatch (RequestFailedException ex)\n{\n    Console.WriteLine($\"Key Vault error: {ex.Status} - {ex.Message}\");\n}\n```\n\n## Required RBAC Roles\n\n| Role | Permissions |\n|------|-------------|\n| Key Vault Crypto Officer | Full key management |\n| Key Vault Crypto User | Use keys for crypto operations |\n| Key Vault Reader | Read key metadata |\n\n## Related SDKs\n\n| SDK | Purpose | Install |\n|-----|---------|---------|\n| `Azure.Security.KeyVault.Keys` | Keys (this SDK) | `dotnet add package Azure.Security.KeyVault.Keys` |\n| `Azure.Security.KeyVault.Secrets` | Secrets | `dotnet add package Azure.Security.KeyVault.Secrets` |\n| `Azure.Security.KeyVault.Certificates` | Certificates | `dotnet add package Azure.Security.KeyVault.Certificates` |\n| `Azure.Identity` | Authentication | `dotnet add package Azure.Identity` |\n\n## Reference Links\n\n| Resource | URL |\n|----------|-----|\n| NuGet Package | https:\u002F\u002Fwww.nuget.org\u002Fpackages\u002FAzure.Security.KeyVault.Keys |\n| API Reference | https:\u002F\u002Flearn.microsoft.com\u002Fdotnet\u002Fapi\u002Fazure.security.keyvault.keys |\n| Quickstart | https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fkey-vault\u002Fkeys\u002Fquick-create-net |\n| GitHub Source | https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-for-net\u002Ftree\u002Fmain\u002Fsdk\u002Fkeyvault\u002FAzure.Security.KeyVault.Keys |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Azure.Security.KeyVault.Keys (.NET)\n\nClient library for managing cryptographic keys in Azure Key Vault and Managed HSM.\n\n## Installation\n\n```bash\ndotnet add package Azure.Security.KeyVault.Keys\ndotnet add package Azure.Identity\n```\n\n**Current Version**: 4.7.0 (stable)\n\n## Environment Variables\n\n```bash\nKEY_VAULT_NAME=\u003Cyour-key-vault-name>\n# Or full URI\nAZURE_KEYVAULT_URL=https:\u002F\u002F\u003Cvault-name>.vault.azure.net\n```\n\n## Client Hierarchy\n\n```\nKeyClient (key management)\n├── CreateKey \u002F CreateRsaKey \u002F CreateEcKey\n├── GetKey \u002F GetKeys\n├── UpdateKeyProperties\n├── DeleteKey \u002F PurgeDeletedKey\n├── BackupKey \u002F RestoreKey\n└── GetCryptographyClient() → CryptographyClient\n\nCryptographyClient (cryptographic operations)\n├── Encrypt \u002F Decrypt\n├── WrapKey \u002F UnwrapKey\n├── Sign \u002F Verify\n└── SignData \u002F VerifyData\n\nKeyResolver (key resolution)\n└── Resolve(keyId) → CryptographyClient\n```\n\n## Authentication\n\n### DefaultAzureCredential (Recommended)\n\n```csharp\nusing Azure.Identity;\nusing Azure.Security.KeyVault.Keys;\n\nvar keyVaultName = Environment.GetEnvironmentVariable(\"KEY_VAULT_NAME\");\nvar kvUri = $\"https:\u002F\u002F{keyVaultName}.vault.azure.net\";\n\nvar client = new KeyClient(new Uri(kvUri), new DefaultAzureCredential());\n```\n\n### Service Principal\n\n```csharp\nvar credential = new ClientSecretCredential(\n    tenantId: \"\u003Ctenant-id>\",\n    clientId: \"\u003Cclient-id>\",\n    clientSecret: \"\u003Cclient-secret>\");\n\nvar client = new KeyClient(new Uri(kvUri), credential);\n```\n\n## Key Management\n\n### Create Keys\n\n```csharp\n\u002F\u002F Create RSA key\nKeyVaultKey rsaKey = await client.CreateKeyAsync(\"my-rsa-key\", KeyType.Rsa);\nConsole.WriteLine($\"Created key: {rsaKey.Name}, Type: {rsaKey.KeyType}\");\n\n\u002F\u002F Create RSA key with options\nvar rsaOptions = new CreateRsaKeyOptions(\"my-rsa-key-2048\")\n{\n    KeySize = 2048,\n    HardwareProtected = false, \u002F\u002F true for HSM-backed\n    ExpiresOn = DateTimeOffset.UtcNow.AddYears(1),\n    NotBefore = DateTimeOffset.UtcNow,\n    Enabled = true\n};\nrsaOptions.KeyOperations.Add(KeyOperation.Encrypt);\nrsaOptions.KeyOperations.Add(KeyOperation.Decrypt);\n\nKeyVaultKey rsaKey2 = await client.CreateRsaKeyAsync(rsaOptions);\n\n\u002F\u002F Create EC key\nvar ecOptions = new CreateEcKeyOptions(\"my-ec-key\")\n{\n    CurveName = KeyCurveName.P256,\n    HardwareProtected = true \u002F\u002F HSM-backed\n};\nKeyVaultKey ecKey = await client.CreateEcKeyAsync(ecOptions);\n\n\u002F\u002F Create Oct (symmetric) key for wrap\u002Funwrap\nvar octOptions = new CreateOctKeyOptions(\"my-oct-key\")\n{\n    KeySize = 256,\n    HardwareProtected = true\n};\nKeyVaultKey octKey = await client.CreateOctKeyAsync(octOptions);\n```\n\n### Retrieve Keys\n\n```csharp\n\u002F\u002F Get specific key (latest version)\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"Key ID: {key.Id}\");\nConsole.WriteLine($\"Key Type: {key.KeyType}\");\nConsole.WriteLine($\"Version: {key.Properties.Version}\");\n\n\u002F\u002F Get specific version\nKeyVaultKey keyVersion = await client.GetKeyAsync(\"my-rsa-key\", \"version-id\");\n\n\u002F\u002F List all keys\nawait foreach (KeyProperties keyProps in client.GetPropertiesOfKeysAsync())\n{\n    Console.WriteLine($\"Key: {keyProps.Name}, Enabled: {keyProps.Enabled}\");\n}\n\n\u002F\u002F List key versions\nawait foreach (KeyProperties version in client.GetPropertiesOfKeyVersionsAsync(\"my-rsa-key\"))\n{\n    Console.WriteLine($\"Version: {version.Version}, Created: {version.CreatedOn}\");\n}\n```\n\n### Update Key Properties\n\n```csharp\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\n\nkey.Properties.ExpiresOn = DateTimeOffset.UtcNow.AddYears(2);\nkey.Properties.Tags[\"environment\"] = \"production\";\n\nKeyVaultKey updatedKey = await client.UpdateKeyPropertiesAsync(key.Properties);\n```\n\n### Delete and Purge Keys\n\n```csharp\n\u002F\u002F Start delete operation\nDeleteKeyOperation operation = await client.StartDeleteKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Wait for deletion to complete (required before purge)\nawait operation.WaitForCompletionAsync();\nConsole.WriteLine($\"Deleted key scheduled purge date: {operation.Value.ScheduledPurgeDate}\");\n\n\u002F\u002F Purge immediately (if soft-delete is enabled)\nawait client.PurgeDeletedKeyAsync(\"my-rsa-key\");\n\n\u002F\u002F Or recover deleted key\nKeyVaultKey recoveredKey = await client.StartRecoverDeletedKeyAsync(\"my-rsa-key\");\n```\n\n### Backup and Restore\n\n```csharp\n\u002F\u002F Backup key\nbyte[] backup = await client.BackupKeyAsync(\"my-rsa-key\");\nawait File.WriteAllBytesAsync(\"key-backup.bin\", backup);\n\n\u002F\u002F Restore key\nbyte[] backupData = await File.ReadAllBytesAsync(\"key-backup.bin\");\nKeyVaultKey restoredKey = await client.RestoreKeyBackupAsync(backupData);\n```\n\n## Cryptographic Operations\n\n### Get CryptographyClient\n\n```csharp\n\u002F\u002F From KeyClient\nKeyVaultKey key = await client.GetKeyAsync(\"my-rsa-key\");\nCryptographyClient cryptoClient = client.GetCryptographyClient(\n    key.Name, \n    key.Properties.Version);\n\n\u002F\u002F Or create directly with key ID\nCryptographyClient cryptoClient = new CryptographyClient(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-rsa-key\u002Fversion\"),\n    new DefaultAzureCredential());\n```\n\n### Encrypt and Decrypt\n\n```csharp\nbyte[] plaintext = Encoding.UTF8.GetBytes(\"Secret message to encrypt\");\n\n\u002F\u002F Encrypt\nEncryptResult encryptResult = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\nConsole.WriteLine($\"Encrypted: {Convert.ToBase64String(encryptResult.Ciphertext)}\");\n\n\u002F\u002F Decrypt\nDecryptResult decryptResult = await cryptoClient.DecryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    encryptResult.Ciphertext);\nstring decrypted = Encoding.UTF8.GetString(decryptResult.Plaintext);\nConsole.WriteLine($\"Decrypted: {decrypted}\");\n```\n\n### Wrap and Unwrap Keys\n\n```csharp\n\u002F\u002F Key to wrap (e.g., AES key)\nbyte[] keyToWrap = new byte[32]; \u002F\u002F 256-bit key\nRandomNumberGenerator.Fill(keyToWrap);\n\n\u002F\u002F Wrap key\nWrapResult wrapResult = await cryptoClient.WrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    keyToWrap);\n\n\u002F\u002F Unwrap key\nUnwrapResult unwrapResult = await cryptoClient.UnwrapKeyAsync(\n    KeyWrapAlgorithm.RsaOaep256, \n    wrapResult.EncryptedKey);\n```\n\n### Sign and Verify\n\n```csharp\n\u002F\u002F Data to sign\nbyte[] data = Encoding.UTF8.GetBytes(\"Data to sign\");\n\n\u002F\u002F Sign data (computes hash internally)\nSignResult signResult = await cryptoClient.SignDataAsync(\n    SignatureAlgorithm.RS256, \n    data);\n\n\u002F\u002F Verify signature\nVerifyResult verifyResult = await cryptoClient.VerifyDataAsync(\n    SignatureAlgorithm.RS256, \n    data, \n    signResult.Signature);\nConsole.WriteLine($\"Signature valid: {verifyResult.IsValid}\");\n\n\u002F\u002F Or sign pre-computed hash\nusing var sha256 = SHA256.Create();\nbyte[] hash = sha256.ComputeHash(data);\n\nSignResult signHashResult = await cryptoClient.SignAsync(\n    SignatureAlgorithm.RS256, \n    hash);\n```\n\n## Key Resolver\n\n```csharp\nusing Azure.Security.KeyVault.Keys.Cryptography;\n\nvar resolver = new KeyResolver(new DefaultAzureCredential());\n\n\u002F\u002F Resolve key by ID to get CryptographyClient\nCryptographyClient cryptoClient = await resolver.ResolveAsync(\n    new Uri(\"https:\u002F\u002Fmyvault.vault.azure.net\u002Fkeys\u002Fmy-key\u002Fversion\"));\n\n\u002F\u002F Use for encryption\nEncryptResult result = await cryptoClient.EncryptAsync(\n    EncryptionAlgorithm.RsaOaep256, \n    plaintext);\n```\n\n## Key Rotation\n\n```csharp\n\u002F\u002F Rotate key (creates new version)\nKeyVaultKey rotatedKey = await client.RotateKeyAsync(\"my-rsa-key\");\nConsole.WriteLine($\"New version: {rotatedKey.Properties.Version}\");\n\n\u002F\u002F Get rotation policy\nKeyRotationPolicy policy = await client.GetKeyRotationPolicyAsync(\"my-rsa-key\");\n\n\u002F\u002F Update rotation policy\npolicy.ExpiresIn = \"P90D\"; \u002F\u002F 90 days\npolicy.LifetimeActions.Add(new KeyRotationLifetimeAction\n{\n    Action = KeyRotationPolicyAction.Rotate,\n    TimeBeforeExpiry = \"P30D\" \u002F\u002F Rotate 30 days before expiry\n});\n\nawait client.UpdateKeyRotationPolicyAsync(\"my-rsa-key\", policy);\n```\n\n## Key Types Reference\n\n| Type | Purpose |\n|------|---------|\n| `KeyClient` | Key management operations |\n| `CryptographyClient` | Cryptographic operations |\n| `KeyResolver` | Resolve key ID to CryptographyClient |\n| `KeyVaultKey` | Key with cryptographic material |\n| `KeyProperties` | Key metadata (no crypto material) |\n| `CreateRsaKeyOptions` | RSA key creation options |\n| `CreateEcKeyOptions` | EC key creation options |\n| `CreateOctKeyOptions` | Symmetric key options |\n| `EncryptResult` | Encryption result |\n| `DecryptResult` | Decryption result |\n| `SignResult` | Signing result |\n| `VerifyResult` | Verification result |\n| `WrapResult` | Key wrap result |\n| `UnwrapResult` | Key unwrap result |\n\n## Algorithms Reference\n\n### Encryption Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `Rsa15` | RSA | RSA 1.5 (legacy) |\n| `A128Gcm` | Oct | AES-128-GCM |\n| `A256Gcm` | Oct | AES-256-GCM |\n\n### Signature Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RS256` | RSA | RSASSA-PKCS1-v1_5 SHA-256 |\n| `RS384` | RSA | RSASSA-PKCS1-v1_5 SHA-384 |\n| `RS512` | RSA | RSASSA-PKCS1-v1_5 SHA-512 |\n| `PS256` | RSA | RSASSA-PSS SHA-256 |\n| `ES256` | EC | ECDSA P-256 SHA-256 |\n| `ES384` | EC | ECDSA P-384 SHA-384 |\n| `ES512` | EC | ECDSA P-521 SHA-512 |\n\n### Key Wrap Algorithms\n| Algorithm | Key Type | Description |\n|-----------|----------|-------------|\n| `RsaOaep` | RSA | RSA-OAEP |\n| `RsaOaep256` | RSA | RSA-OAEP-256 |\n| `A128KW` | Oct | AES-128 Key Wrap |\n| `A256KW` | Oct | AES-256 Key Wrap |\n\n## Best Practices\n\n1. **Use Managed Identity** — Prefer `DefaultAzureCredential` over secrets\n2. **Enable soft-delete** — Protect against accidental deletion\n3. **Use HSM-backed keys** — Set `HardwareProtected = true` for sensitive keys\n4. **Implement key rotation** — Use automatic rotation policies\n5. **Limit key operations** — Only enable required `KeyOperations`\n6. **Set expiration dates** — Always set `ExpiresOn` for keys\n7. **Use specific versions** — Pin to versions in production\n8. **Cache CryptographyClient** — Reuse for multiple operations\n\n## Error Handling\n\n```csharp\nusing Azure;\n\ntry\n{\n    KeyVaultKey key = await client.GetKeyAsync(\"my-key\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 404)\n{\n    Console.WriteLine(\"Key not found\");\n}\ncatch (RequestFailedException ex) when (ex.Status == 403)\n{\n    Console.WriteLine(\"Access denied - check RBAC permissions\");\n}\ncatch (RequestFailedException ex)\n{\n    Console.WriteLine($\"Key Vault error: {ex.Status} - {ex.Message}\");\n}\n```\n\n## Required RBAC Roles\n\n| Role | Permissions |\n|------|-------------|\n| Key Vault Crypto Officer | Full key management |\n| Key Vault Crypto User | Use keys for crypto operations |\n| Key Vault Reader | Read key metadata |\n\n## Related SDKs\n\n| SDK | Purpose | Install |\n|-----|---------|---------|\n| `Azure.Security.KeyVault.Keys` | Keys (this SDK) | `dotnet add package Azure.Security.KeyVault.Keys` |\n| `Azure.Security.KeyVault.Secrets` | Secrets | `dotnet add package Azure.Security.KeyVault.Secrets` |\n| `Azure.Security.KeyVault.Certificates` | Certificates | `dotnet add package Azure.Security.KeyVault.Certificates` |\n| `Azure.Identity` | Authentication | `dotnet add package Azure.Identity` |\n\n## Reference Links\n\n| Resource | URL |\n|----------|-----|\n| NuGet Package | https:\u002F\u002Fwww.nuget.org\u002Fpackages\u002FAzure.Security.KeyVault.Keys |\n| API Reference | https:\u002F\u002Flearn.microsoft.com\u002Fdotnet\u002Fapi\u002Fazure.security.keyvault.keys |\n| Quickstart | https:\u002F\u002Flearn.microsoft.com\u002Fazure\u002Fkey-vault\u002Fkeys\u002Fquick-create-net |\n| GitHub Source | https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-for-net\u002Ftree\u002Fmain\u002Fsdk\u002Fkeyvault\u002FAzure.Security.KeyVault.Keys |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":27,"source":32,"date_added":44,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcursor\u002Fazure-security-keyvault-keys-dotnet","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-dotnet",{"tool":57,"command":58},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-dotnet",{"tool":60,"command":61},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill azure-security-keyvault-keys-dotnet","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcursor\u002Fazure-security-keyvault-keys-dotnet\u002FSKILL.md",true,[],[66,90,116,126,139,158],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":77,"publishedAt":39},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[72],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[78,79,80,81,82,83,84,85,86,87,88,89],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[97,98,99,100,101,102,80,103,104,105,106,107,108,109,110,111,112,113,114,115],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":39},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[123,124,97,108,109,110,111,101,80,113,125,114,115,107,105,104,103,112,102,100],"trend radar","radar","pulse",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":39},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[133,134,135,136,137,138],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":150,"publishedAt":39},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[145],{"categoryNo":146,"categoryName":147,"taxonomyType":148,"taxonomyTypeDesc":149},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[141,86,151,152,153,89,108,154,155,156,99,157,112],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":39},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[160,165,166,167,112,168,155,169,170,171,172,173],"status","play","go","latest","github","discover","control","cmd","volume"]