Manage Azure Key Vault Keys and Secrets

Azure Key Vault Keys SDK for TypeScript manages cryptographic keys (and, via a paired package, secrets) with Azure Key Vault through KeyClient, SecretClient, and CryptographyClient, authenticated with DefaultAzureCredential. It is Node.js only - the SDKs explicitly don't support browser use.

Secrets support create/set (with optional enabled flag, expiration, content type, and tags), get (latest or a specific version), list (all secrets or all versions of one), and delete through a soft-delete/purge/recover lifecycle using long-running pollers. Keys support generic creation or type-specific helpers (createRsaKey with a key size, createEcKey with a named curve), with the same attribute options plus a keyOps list restricting what operations the key permits; keys can be listed, manually rotated on demand, or governed by a rotation policy (an expiry duration and a lifetime action to rotate a configurable number of days before expiry), and deleted/purged the same way as secrets. Cryptographic operations run through a CryptographyClient built from a key object or its ID: encrypt/decrypt (e.g. RSA-OAEP over a plaintext/ciphertext buffer), sign/verify over a hash digest (e.g. RS256 over a SHA-256 digest), and wrap/unwrap for encrypting other key material for storage. Both keys and secrets can be backed up to an opaque blob and restored - including restoring to a different vault than the one they were backed up from.

Use it when a Node.js application needs to manage cryptographic keys, secrets, and run encryption/signing operations centrally in Key Vault rather than storing key material or secrets in application code. It's explicitly not for browser applications - reach for a different auth/architecture if you need client-side secret access.

Input is a key/secret name and its configuration (type, size/curve, expiration, allowed operations), or plaintext/ciphertext/hash data for cryptographic operations. Output is the created/fetched KeyVaultKey or KeyVaultSecret, or an encrypt/decrypt/sign/verify/wrap/unwrap result. Install it with:

npm install @azure/keyvault-keys @azure/identity

Its own best practices: use DefaultAzureCredential for consistent auth across dev and production, enable soft-delete (required for production vaults), set expiration dates on both keys and secrets, use rotation policies to automate key rotation rather than manual rotation, and limit keyOps to only the operations a key actually needs. Errors surface as exceptions with a code property, such as SecretNotFound for a missing secret.

It's the @azure/keyvault-keys package (with @azure/keyvault-secrets for the secrets half) paired with @azure/identity for DefaultAzureCredential authentication against an Azure Key Vault instance.

Node.js developers who need to manage cryptographic keys and secrets and run encryption, signing, or key-wrapping operations centrally in Key Vault, with rotation policies and soft-delete recovery built in.