Obtain primary, secondary, read, or read-write keys in Azure Cosmos DB

Use the Azure portal to obtain either of the four built-in keys:

• Primary read-write
• Primary read-only
• Secondary read-write
• Secondary read-only

1. Sign in to the Azure portal (https://portal.azure.com).

2. Navigate to your existing Azure Cosmos DB account.

3. In the account resource pane, select Keys from the Settings section of the service menu.

4. Locate and record the value of the Primary Key or Secondary Key fields in either the Read-write Keys or Read-only section.

   Tip

   You may need to show the keys before recording their values. By default, the keys are hidden.

Use this Azure CLI script to get keys or connection strings from your Azure Cosmos DB account.

az cosmosdb keys list \
    --resource-group "<name-of-existing-resource-group>" \
    --name "<name-of-existing-account>" \
    --type "keys"

--type argument options include:

• connection-strings
• keys
• read-only-keys

For more information, see az cosmosdb keys list.

Use this Azure PowerShell script to get keys or connection strings from your Azure Cosmos DB account.

$parameters = @{
    ResourceGroupName = "<name-of-existing-resource-group>"
    Name = "<name-of-existing-account>"
    Type = "Keys"
}
Get-AzCosmosDBAccountKey @parameters

Type parameter options include:

• ConnectionStrings
• Keys
• ReadOnlyKeys

For more information, see Get-AzCosmosDBAccountKey.

This example Bicep template outputs all credentials for an existing Azure Cosmos DB account.

metadata description = 'Gets all keys and connection strings for an Azure Cosmos DB account.'

@description('The name of the Azure Cosmos DB account.')
param accountName string

resource account 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' existing = {
  name: accountName
}

output endpoint string = account.properties.documentEndpoint

var keys = account.listKeys()

output keys object = {
  primary: {
    readWrite: keys.primaryMasterKey
    readOnly: keys.primaryReadonlyMasterKey
  }
  secondary: {
    readWrite: keys.secondaryMasterKey
    readOnly: keys.secondaryReadonlyMasterKey
  }
}

var connectionStrings = account.listConnectionStrings()

output connectionStrings object = {
  primary: {
    readWrite: connectionStrings.connectionStrings[0].connectionString
    readOnly: connectionStrings.connectionStrings[1].connectionString
  }
  secondary: {
    readWrite: connectionStrings.connectionStrings[2].connectionString
    readOnly: connectionStrings.connectionStrings[3].connectionString
  }
}