Skip to content

Export a key's public part

Take the public key material and metadata of a key in your tenant, as JSON, to hand to a partner or another system that encrypts to the key or verifies its signatures. Private key material never leaves the platform.

Who can do it

Anyone who holds the permission to read keys: every built-in tenant role, and every built-in platform role working inside the tenant. On a SaaS deployment a platform administrator is refused.

Before you start

  • The key is asymmetric or composite. A symmetric key has no public part, so the console does not offer the export for it.
  • The key is exportable. Whether a key may be exported, public key included, is set when it is created and can be changed with its metadata.
  • The key is active or suspended. The console offers the export in those two states only.

Steps

  1. Open Key Inventory, find the key and select its row, or View Details.
  2. On Details, check that Exportable reads yes.
  3. Select Export Public Key in the footer of the key's detail.
  4. In the Export Public Key dialog, check the Key ID and algorithm, and the preview of the JSON.
  5. Select Copy to Clipboard, or Download as JSON to save it as <Key ID>-public.json.

What you see when it worked

The dialog shows the beginning of the exported JSON. A simple asymmetric key carries its public key as Base64 SubjectPublicKeyInfo; a composite key carries the public key of each component and no single public key. Copy to Clipboard confirms with "Public key JSON copied."

If it fails

What you see Cause What to do
Export Public Key is not offered The key is symmetric, not exportable, or in a state other than active or suspended For a non-exportable key, a person with the permission to edit key metadata makes it exportable, if your policy allows it
"Key is not exportable" The key is marked non-exportable As above
"Failed to export key", or the server's refusal The export was refused, for example because the key's recorded state could not be verified Retry later; if it persists, report the key's identifier to your platform operator
The export is refused for a platform administrator On a SaaS deployment, a platform administrator cannot export a tenant's key Ask a person of the tenant to export it

Without the console

Surface How
Key management CLI ankasecure-km keys export --kid <id>
Admin SDK KeyOperations.export(String)
API GET /api/v3/admin/tenants/{tenantId}/keys/{kid}/export (operation exportKey)
  • Key Inventory: what the screen shows, including whether a key may be exported.