KeyClient class

创建 KeyClient 的实例。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

// Build the URL to reach your key vault
const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`; // or `https://${vaultName}.managedhsm.azure.net` for managed HSM.

// Lastly, create our keys client and connect to the service
const client = new KeyClient(url, credential);

new KeyClient(vaultUrl: string, credential: TokenCredential, pipelineOptions?: KeyClientOptions)

参数

保管库的基 URL

vaultUrl: string

属性值

请求将指定密钥的备份下载到客户端。 将下载密钥的所有版本。 此作需要密钥/备份权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

备份指定的键。

function backupKey(name: string, options?: BackupKeyOptions): Promise<undefined | Uint8Array>

参数

返回

删除作适用于 Azure Key Vault 中存储的任何密钥。 无法删除单个版本的密钥，只能同时删除给定密钥的所有版本。

此函数返回一个长时间运行的作轮询程序，该轮询程序允许无限期等待，直到删除密钥。

此作需要密钥/删除权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const poller = await client.beginDeleteKey(keyName);
await poller.pollUntilDone();

从指定的密钥保管库中删除密钥。

function beginDeleteKey(name: string, options?: BeginDeleteKeyOptions): Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

参数

返回

恢复指定保管库中已删除的密钥。 此作只能在启用软删除的保管库上执行。

此函数返回一个长时间运行的作轮询程序，该轮询程序允许无限期等待，直到恢复已删除的密钥。

此作需要密钥/恢复权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

const recoverPoller = await client.beginRecoverDeletedKey(keyName);
const recoveredKey = await recoverPoller.pollUntilDone();

将已删除的密钥恢复到最新版本。

function beginRecoverDeletedKey(name: string, options?: BeginRecoverDeletedKeyOptions): Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

参数

返回

createEcKey 方法在 Azure Key Vault 中创建新的椭圆曲线密钥。 如果已存在命名密钥，Azure Key Vault 将创建密钥的新版本。 它需要密钥/创建权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createEcKey(keyName, { curve: "P-256" });
console.log("result: ", result);

创建一个新密钥，将其存储，然后将密钥参数和属性返回到客户端。

function createEcKey(name: string, options?: CreateEcKeyOptions): Promise<KeyVaultKey>

参数

返回

创建密钥作可用于在 Azure Key Vault 中创建任何密钥类型。 如果已存在命名密钥，Azure Key Vault 将创建密钥的新版本。 它需要密钥/创建权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createKey(keyName, "RSA");
console.log("result: ", result);

创建一个新密钥，将其存储，然后将密钥参数和属性返回到客户端。

function createKey(name: string, keyType: string, options?: CreateKeyOptions): Promise<KeyVaultKey>

参数

返回

createOctKey 方法在 Azure Key Vault 中创建新的 OCT 密钥。 如果已存在命名密钥，Azure Key Vault 将创建密钥的新版本。 它需要密钥/创建权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createOctKey("MyKey", { hsm: true });
console.log("result: ", result);

创建一个新密钥，将其存储，然后将密钥参数和属性返回到客户端。

function createOctKey(name: string, options?: CreateOctKeyOptions): Promise<KeyVaultKey>

参数

返回

createRSAKey 方法在 Azure Key Vault 中创建新的 RSA 密钥。 如果已存在命名密钥，Azure Key Vault 将创建密钥的新版本。 它需要密钥/创建权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createRsaKey("MyKey", { keySize: 2048 });
console.log("result: ", result);

创建一个新密钥，将其存储，然后将密钥参数和属性返回到客户端。

function createRsaKey(name: string, options?: CreateRsaKeyOptions): Promise<KeyVaultKey>

参数

返回

获取给定密钥的 CryptographyClient。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

// Get a cryptography client for a given key
const cryptographyClient = client.getCryptographyClient("MyKey");

function getCryptographyClient(keyName: string, options?: GetCryptographyClientOptions): CryptographyClient

参数

返回

• CryptographyClient 使用与此 keyClient 相同的选项、凭据和 http 客户端

getDeletedKey 方法返回指定的已删除键及其属性。 此作需要密钥/获取权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

await client.getDeletedKey(keyName);

获取指定的已删除密钥。

function getDeletedKey(name: string, options?: GetDeletedKeyOptions): Promise<DeletedKey>

参数

返回

getKey 方法获取指定的密钥，适用于 Azure Key Vault 中存储的任何密钥。 此作需要密钥/获取权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKey(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKey(keyName, { version: latestKey.properties.version! });
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

从给定的密钥保管库中获取指定的密钥。

function getKey(name: string, options?: GetKeyOptions): Promise<KeyVaultKey>

参数

返回

getKeyAttestation 方法获取指定的密钥及其证明 Blob，适用于 Azure Key Vault 托管 HSM 中存储的任何密钥。 此作需要密钥/获取权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT MANAGED HSM NAME>";
const url = `https://${vaultName}.managedhsm.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKeyAttestation(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKeyAttestation(keyName, {
  version: latestKey.properties.version!,
});
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

从给定的密钥保管库中获取指定的密钥。

function getKeyAttestation(name: string, options?: GetKeyAttestationOptions): Promise<KeyVaultKey>

参数

返回

获取 Key Vault 密钥的轮换策略。 默认情况下，所有密钥都有一个策略，该策略将在到期前 30 天通知。

此作需要密钥/获取权限。 示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.getKeyRotationPolicy(keyName);

function getKeyRotationPolicy(keyName: string, options?: GetKeyRotationPolicyOptions): Promise<KeyRotationPolicy>

参数

返回

获取从托管 HSM 获取包含随机值的请求字节数。 此作需要 managedHsm/rng 权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const bytes = await client.getRandomBytes(10);

function getRandomBytes(count: number, options?: GetRandomBytesOptions): Promise<Uint8Array>

参数

返回

导入密钥作可用于将任何密钥类型导入 Azure Key Vault。 如果已存在命名密钥，Azure Key Vault 将创建密钥的新版本。 此作需要密钥/导入权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const jsonWebKey = {
  kty: "RSA",
  kid: "test-key-123",
  use: "sig",
  alg: "RS256",
  n: new Uint8Array([112, 34, 56, 98, 123, 244, 200, 99]),
  e: new Uint8Array([1, 0, 1]),
  d: new Uint8Array([45, 67, 89, 23, 144, 200, 76, 233]),
  p: new Uint8Array([34, 89, 100, 77, 204, 56, 29, 77]),
  q: new Uint8Array([78, 99, 201, 45, 188, 34, 67, 90]),
  dp: new Uint8Array([23, 45, 78, 56, 200, 144, 32, 67]),
  dq: new Uint8Array([12, 67, 89, 144, 99, 56, 23, 45]),
  qi: new Uint8Array([78, 90, 45, 201, 34, 67, 120, 55]),
};

const result = await client.importKey("MyKey", jsonWebKey);

导入外部创建的密钥、存储密钥，并将密钥参数和属性返回到客户端。

function importKey(name: string, key: JsonWebKey, options?: ImportKeyOptions): Promise<KeyVaultKey>

参数

返回

循环访问保管库中已删除的密钥。 响应中提供了完整的密钥标识符和属性。 不会为键返回任何值。 此作需要密钥/列表权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保管库中的所有密钥

function listDeletedKeys(options?: ListDeletedKeysOptions): PagedAsyncIterableIterator<DeletedKey, DeletedKey[], PageSettings>

参数

返回

循环访问保管库中所有密钥的最新版本。 响应中提供了完整的密钥标识符和属性。 不会为键返回任何值。 此作需要密钥/列表权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保管库中的所有密钥

function listPropertiesOfKeys(options?: ListPropertiesOfKeysOptions): PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

参数

返回

循环访问保管库中给定密钥的所有版本。 响应中提供了完整的密钥标识符、属性和标记。 此作需要密钥/列表权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

function listPropertiesOfKeyVersions(name: string, options?: ListPropertiesOfKeyVersionsOptions): PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

参数

返回

清除删除的密钥作会永久删除密钥，且无法恢复。 只能在启用软删除的保管库上启用此作。 此作需要密钥/清除权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

await client.purgeDeletedKey(keyName);

永久删除指定的键。

function purgeDeletedKey(name: string, options?: PurgeDeletedKeyOptions): Promise<void>

参数

返回

从托管 HSM 释放密钥。

发布密钥作适用于所有密钥类型。 该作要求将密钥标记为可导出，以及密钥/释放权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.releaseKey("myKey", "<attestation-target>");

function releaseKey(name: string, targetAttestationToken: string, options?: ReleaseKeyOptions): Promise<ReleaseKeyResult>

参数

返回

将备份的密钥及其所有版本还原到保管库。 此作需要密钥/还原权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

const key = await client.restoreKeyBackup(backupContents);

将备份的密钥还原到保管库。

function restoreKeyBackup(backup: Uint8Array, options?: RestoreKeyBackupOptions): Promise<KeyVaultKey>

参数

返回

通过生成密钥的新版本来根据密钥策略轮换密钥。 此作需要密钥/轮换权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

// Set the key's automated rotation policy to rotate the key 30 days before expiry.
const policy = await client.updateKeyRotationPolicy(keyName, {
  lifetimeActions: [
    {
      action: "Rotate",
      timeBeforeExpiry: "P30D",
    },
  ],
  // You may also specify the duration after which any newly rotated key will expire.
  // In this case, any new key versions will expire after 90 days.
  expiresIn: "P90D",
});

// You can get the current key rotation policy of a given key by calling the getKeyRotationPolicy method.
const currentPolicy = await client.getKeyRotationPolicy(keyName);

// Finally, you can rotate a key on-demand by creating a new version of the given key.
const rotatedKey = await client.rotateKey(keyName);

function rotateKey(name: string, options?: RotateKeyOptions): Promise<KeyVaultKey>

参数

返回

updateKeyProperties 方法更改现有存储密钥的指定属性。 未在请求中指定的属性保持不变。 无法更改键本身的值。 此作需要密钥/设置权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新与给定密钥保管库中的指定密钥关联的属性。

function updateKeyProperties(name: string, keyVersion: string, options?: UpdateKeyPropertiesOptions): Promise<KeyVaultKey>

参数

返回

updateKeyProperties 方法更改现有存储密钥的最新版本的指定属性。 未在请求中指定的属性保持不变。 无法更改键本身的值。 此作需要密钥/设置权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新与给定密钥保管库中的指定密钥关联的属性。

function updateKeyProperties(name: string, options?: UpdateKeyPropertiesOptions): Promise<KeyVaultKey>

参数

返回

更新 Key Vault 密钥的轮换策略。 此作需要密钥/更新权限。

示例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const myPolicy = await client.getKeyRotationPolicy(keyName);

const setPolicy = await client.updateKeyRotationPolicy(keyName, myPolicy);

function updateKeyRotationPolicy(keyName: string, policy: KeyRotationPolicyProperties, options?: UpdateKeyRotationPolicyOptions): Promise<KeyRotationPolicy>

参数

返回