Skip to content

Import an existing key

Bring the public key of a key that already exists elsewhere, such as a partner's encryption or verification key, into your tenant, so applications can encrypt to it or verify with it under one identifier.

Who can do it

A tenant administrator, a tenant key manager, or a platform super administrator working inside the tenant. The console offers Import Key to a person who holds the permission to import a public key or the permission to import a keystore, and enables the Import from JSON tab only with the permission to import a public key.

Before you start

  • This import accepts public key material only. A private key is never accepted here; to bring a private key into the tenant, migrate a keystore instead.
  • Prepare one .json file describing the key. It must carry kid (the Key ID the key will hold for life), kty (a published key type) and alg. A simple key carries publicKey as Base64; a composite key names in alg a pairing this deployment's catalogue carries and supplies a public key per component.
  • Only public key operations can be requested: encrypt, verify, wrapKey and deriveKey, and only those the algorithm supports.
  • The algorithm must be one your tenant's algorithm policy admits.
  • A deployment licence is in effect, and the tenant's lifecycle state still permits key lifecycle operations.

Steps

  1. Open Import Key from your tenant's navigation.
  2. Select Import from JSON. It is the tab the screen opens on when you hold the permission for it.
  3. Under Step 1 — Upload File, drag the .json file onto the drop area, or select it to browse. Select Remove to choose another file.
  4. Under Step 2 — Preview & Validate, check what the console read from the file: the Key ID, the type, the algorithm and the key operations. The console checks only that the file is valid JSON and carries kid, kty and alg; every other decision belongs to the server.
  5. Select Import Key. It is enabled only when both checks pass.

What you see when it worked

The console shows Key imported successfully with the key's Key ID, type and algorithm, and the status and origin the server returned for it. The origin of an imported key is IMPORTED. The import is recorded in the audit trail.

Select View in Inventory to open Key Inventory, where the key is managed from then on like any other key. Importing does not authorize anyone to use the key: use is authorized separately.

If it fails

What you see Cause What to do
"Invalid JSON: could not parse file contents." The file is not valid JSON Correct the file and upload it again
"Missing kid, kty, or alg field" One of the three required members is absent Add the missing member
The import is refused as invalid input Malformed Base64, a private key operation requested, a key type outside the published vocabulary, or a composite pairing the catalogue does not carry Correct the file as the message says
The import is refused naming the algorithm policy The tenant's algorithm policy does not admit the algorithm Use an admitted algorithm, or ask an administrator to review the algorithm policy
The import is refused as a conflict A key with this Key ID exists with different public material, or the Key ID is already held Choose another Key ID
The import is refused for the licence No deployment licence is in effect A platform administrator installs a valid licence
The Import from JSON tab is disabled, with "Your role does not include this import" You do not hold the permission to import a public key Ask an administrator for the permission

Without the console

Surface How
Key management CLI ankasecure-km keys import-key --body-file <json> (- reads standard input)
Admin SDK KeyOperations.importKey(KeyImportRequest)
API POST /api/v3/admin/tenants/{tenantId}/keys/import-key (operation importKey)
  • Import Key: the two kinds of import and what each one commits you to.
  • Key Inventory: where the imported key is managed.