Skip to content

Create a key

Create a new cryptographic key in your tenant, ready for applications to encrypt, decrypt, sign or verify with it.

Who can do it

A tenant administrator or a tenant key manager. The console offers Generate Key only to a person who holds the permission to create keys.

Before you start

  • The tenant has a key protection backend. Until one is configured, the console refuses to create keys and says so.
  • Decide whether you want a single-algorithm key or a hybrid (composite) key. A hybrid key combines a classical and a post-quantum algorithm in one key.

Steps

  1. Open Key Inventory from the tenant's navigation.
  2. Select Generate Key.
  3. Choose how to build the key:
    • Single Algorithm — Guided answers a few questions about your use case and recommends an algorithm.
    • Single Algorithm — Advanced lets you choose any algorithm in the catalogue and every parameter.
    • Hybrid / Composite Key combines a classical and a post-quantum algorithm.
  4. In the guided path, complete each step and select Continue:
    1. Key identifier (optional): a name your applications will use. Leave it empty and the console generates a unique one. Only lowercase letters, numbers, hyphens and underscores are accepted.
    2. Purpose: Encrypt Data or Sign Documents.
    3. Sensitivity: from Public / Low to Top Secret / Critical. The console recommends an algorithm for that sensitivity and shows the alternatives.
    4. Lifecycle: Development, Testing, Production or Compliance. Each sets the expiry, the usage limit and whether the key can be exported.
    5. Review & Generate: check the Configuration Summary.
  5. Select Generate Key.

What you see when it worked

The console shows Key Generated with the key's identifier, and the creation is recorded in the audit trail. Select View Key to open the key's detail: it shows the key as active, with its algorithm, lifecycle limits and first material version.

The key appears in Key Inventory, and applications can use it under its identifier as soon as they are authorized to.

If it fails

What you see Cause What to do
Creating a key is refused because no key protection backend is configured The tenant has no backend, or its edition's managed HSM tier is on a PKCS#11 module that does not serve the tier's token A tenant administrator configures the key protection backend, or a platform operator corrects the tier, then you retry
The identifier is rejected It contains characters other than lowercase letters, numbers, hyphens and underscores Correct it, or leave it empty
The identifier is already in use A key with that identifier exists, or existed: an identifier is never reused in a tenant Choose another identifier
No algorithm can be recommended The algorithm policy admits none of the candidates for that purpose and sensitivity Use Single Algorithm — Advanced, or ask an administrator to review the algorithm policy

Without the console

Surface How
Key management CLI ankasecure-km keys create --kid <id> --algorithm <algorithm> --purpose <purpose>, or --body-file with the full request
Admin SDK KeyOperations.create(OrchestrationKeyRequest)
API POST /api/v3/admin/tenants/{tenantId}/keys (operation createKey)
  • Key Inventory: what the screen shows and every decision you make on it.