Manage Secrets, Keys, and Certificates in Azure Key Vault

Azure Key Vault SDK for Python covers secure storage and management of secrets, cryptographic keys, and certificates through three separate clients - SecretClient, KeyClient, CertificateClient - plus a CryptographyClient for crypto operations, all authenticated with DefaultAzureCredential.

SecretClient sets and gets secrets (by name, or a specific version), lists secret names and versions without exposing values, and deletes through a soft-delete/purge/recover lifecycle via long-running pollers. KeyClient creates RSA (with a key size) or EC (with a named curve) keys, gets and lists them, and deletes them the same way. CryptographyClient, built from a key object or its ID, runs encrypt/decrypt (e.g. rsa_oaep over plaintext/ciphertext bytes) and sign/verify over a hash digest (e.g. rs256 over a SHA-256 digest), returning a ciphertext/plaintext or a signature/validity result. CertificateClient creates a certificate from a policy (a default self-signed policy or a custom one), gets a certificate's properties and thumbprint, and - notably - retrieves a certificate's private key by reading it as a secret through SecretClient, since the private key material is stored there in PEM or PKCS12 form. All three main clients mirror their sync API in an async form for high-throughput use.

Use it when a Python application needs centralized, auditable secrets, cryptographic keys, or certificates in Key Vault rather than storing them in application code or config files. Use managed identity for authentication when running in Azure-hosted compute, and prefer RBAC over the older access-policy model for fine-grained permission control, per the skill's own best practices.

Input is a secret/key/certificate name and its value or generation parameters, or plaintext/ciphertext/digest data for cryptographic operations. Output is the stored or retrieved secret/key/certificate, or an encrypt/decrypt/sign/verify result. Install only what you need:

pip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity

Its own best practices: use DefaultAzureCredential for authentication and managed identity in Azure-hosted apps, rely on soft-delete (enabled by default) for recovery, prefer RBAC over access policies, rotate secrets regularly using their built-in versioning, reference secrets directly from App Service/Functions configuration rather than fetching them in code, cache secrets appropriately to cut API calls, and use the async clients for high-throughput scenarios. Errors surface as ResourceNotFoundError for a missing item or HttpResponseError (status 403 signals an RBAC/access-policy permission problem).

It's the azure-keyvault-secrets/azure-keyvault-keys/azure-keyvault-certificates packages paired with azure-identity, and integrates with App Service/Functions configuration via Key Vault references so secrets don't need to be fetched explicitly in application code.

Python developers who need centralized, auditable secrets, cryptographic key, and certificate management in Azure Key Vault - including running encryption/signing operations against those keys - rather than handling sensitive material in application code.