Manage Azure Key Vault Keys with Java

Azure Key Vault Keys for Java is a client library for managing cryptographic keys and performing cryptographic operations in Azure Key Vault and Managed HSM, via a KeyClient (management, sync or async) and a separate CryptographyClient (encrypt/decrypt/sign/verify/wrap/unwrap), both authenticating with DefaultAzureCredentialBuilder.

It supports six key types - RSA (2048/3072/4096-bit) and its HSM-backed variant, EC (curves P-256, P-384, P-521) and its HSM-backed variant, and symmetric OCT keys (Managed HSM only, plain or HSM-backed). Key creation options include expiry and not-before dates, enabled state, allowed key operations (encrypt/decrypt/wrap/unwrap), tags, and hardware-protection (HSM-backed). Keys can be fetched by name (latest version), by specific version, or as properties only (without key material); updated (enabled state, expiry, tags, operations); listed (all keys or all versions of one key); and deleted through a soft-delete/purge/recover lifecycle for vaults with soft-delete enabled.

Cryptographic operations run through CryptographyClient, scoped to a specific key: encrypt/decrypt (e.g. RSA_OAEP), sign/verify over a hash digest (e.g. RS256 over a SHA-256 digest), and wrap/unwrap of another key's raw bytes (e.g. wrapping a 256-bit AES key with RSA_OAEP). Keys can be backed up to an opaque blob and restored from it, rotated to a new version on demand, or governed by a rotation policy that expires a key after a set duration and rotates it a configurable number of days before expiry. Existing key material (RSA components like modulus/exponent) can be imported as a JsonWebKey rather than generated in the vault.

Supported encryption algorithms span RSA1_5, RSA_OAEP (recommended), and RSA_OAEP_256 for RSA keys, plus A128GCM/A256GCM/A128CBC/A256CBC for symmetric (OCT) keys. Supported signature algorithms are RS256/RS384/RS512 and PS256 for RSA, and ES256/ES384/ES512 for the matching EC curve. Errors surface as ResourceNotFoundException for a missing key or the general HttpResponseException with an HTTP status code.

Use it when you need centrally-managed, auditable cryptographic keys - for encryption, signing, or key wrapping - backed by Key Vault or Managed HSM, rather than keys generated and stored in application code. For production or sensitive keys, its own best practices call for HSM-backed keys and soft delete specifically (a sample rotation policy expires a key after 90 days and rotates it 30 days before expiry), and for high-throughput crypto operations, using CryptographyClient with local key material (when the key allows export) to avoid a network round-trip per operation.

Input is a key name/type/size/curve and its configuration, or plaintext/ciphertext/data-to-sign for cryptographic operations. Output is the created or fetched KeyVaultKey, or an encrypt/decrypt/sign/verify/wrap/unwrap result. Install it with:

<dependency>
    <groupId>com.azure</groupId>
    <artifactId>azure-security-keyvault-keys</artifactId>
    <version>4.9.0</version>
</dependency>

Its own best practices: use HSM-backed keys for production, enable soft delete, set up automatic rotation policies, use separate keys per operation type (least privilege), and prefer local cryptography with exportable key material to cut round-trips.

It's the com.azure:azure-security-keyvault-keys client paired with azure-identity for authentication against an Azure Key Vault or Managed HSM instance.

Java developers and security engineers who need to manage cryptographic keys and perform encryption, signing, or key-wrapping operations backed by Azure Key Vault or Managed HSM, with rotation, soft-delete, and HSM-backing built in.