---
title: "Getting started with OVHcloud Key Management Service (KMS)"
description: "Learn the steps you need to take to set up your first Key Management Service (KMS) and to create a key and access certificate."
url: https://docs.us.ovhcloud.com/en/manage-and-operate/kms/quick-start
lang: en
---
> For AI agents: the complete documentation index is available at https://docs.us.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.us.ovhcloud.com/en/llms-full.txt.

# Getting started with OVHcloud Key Management Service (KMS)

**Learn the steps you need to take to set up your first Key Management Service (KMS) and to create a key and access certificate.**

 

## Requirements

- An [OVHcloud customer account](https://docs.us.ovhcloud.com/en/account/account-information/create-account.md)

 

## Instructions

### Ordering your KMS

Each KMS is associated with a region, so the keys stored there are guaranteed to stay there. You can order multiple Key Management Services in different regions or the same region.

Since the billing for a KMS is based on the number of keys stored on it, ordering a KMS does not generate billing until keys are created.

You can order a KMS from the [OVHcloud Control Panel](https://manager.us.ovhcloud.com/) by going to one of the following menus:

1. In the top navigation bar, choose either `Bare Metal Cloud` or `Hosted Private Cloud`.
2. In the left-hand menu, select `Identity, Security & Operations`, and then `Key Management Service`.
3. Click `Order`.

Choose a region for your KMS.

You can then finalize the order in another tab. If it has not opened automatically, the URL is displayed:

After a few seconds, the KMS will be available in your OVHcloud Control Panel.

**Warning:**

**NOTE:** The _more options_ `...` button to the right of your service is where you can cancel that service.

 

### Creating an encryption key

**Tip:**

Click each tab across the top to view all content.

#### Via OVHcloud Control Panel

You can create an encryption key from the OVHcloud Control Panel by selecting the KMS service you just created, choosing the `Encryption keys` tab, and clicking the `+ Create a key` button.

A form allows you to configure the key and select its type, size, and usage. Click `Confirm` when you have made your selections.

Once the key is created, click on it to access its details. The dashboard displays the cryptographic properties of the key and the actions for renaming, disabling, or deleting it.
To reduce the risk of unwanted deletion, it is required to disable the key before deleting it.

**Warning:** **NOTE:** A deleted key is not recoverable and results in the loss of any data encrypted with it. Deletions should be performed with great caution.

#### Via API

You can create (or import) a key using the following API:

[POST /okms/resource/{okmsId}/serviceKey](https://api.us.ovhcloud.com/console/?section=/okms&branch=v2#post-/okms/resource/-okmsId-/serviceKey)

The API expects the following values:
| **Field**  | **Value**           | **Description**                                                                  |
| ---------- | ------------------- | -------------------------------------------------------------------------------- |
| name       | string              | Key name                                                                         |
| context    | string              | Additional credential to verify key authenticity                                 |
| type       | oct, RSA, EC        | Key type: Byte sequence (oct) for symmetric keys, RSA (RSA), Elliptic Curve (EC) |
| size       | Integer             | Key size - see lookup below                                                      |
| operations | Array               | Key Usage - see lookup below                                                     |
| curve      | P-256, P-384, P-521 | (optional) Cryptographic curve for EC type keys                                  |
 

#### Example of symmetric key creation:

```json
{
  "name": "My first AES key",
  "context": "project A",
  "type": "oct",
  "size": 256,
  "operations": [
    "encrypt",
    "decrypt"
  ]
}
```

#### Example of asymmetric key creation:

```json
{
  "name": "My first RSA key",
  "context": "project A",
  "type": "RSA",
  "size": 4096,
  "operations": [
    "sign",
    "verify"
  ]
}
```

#### Example of EC key creation:

```json
{
  "name": "My first EC key",
  "context": "project A",
  "type": "EC",
  "operations": [
    "sign",
    "verify"
  ],
  "curve": "P-256"
}
```

Depending on the key type, the possible sizes and operations are:
- **Oct**:

  - size: 128, 192, 256

  - operations:

    - encrypt, decrypt
    - wrapKey, unwrapKey

- **RSA**:

  - size: 2048, 3072, 4096
  - operations: sign, verify

- **EC**:

  - size: do not specify
  - curve: P-256, P-384, P-521
  - operations: sign, verify

 

### Creating an access certificate

To communicate with your KMS, you will need to create an access certificate. This will be used for any interaction with the KMS, either to create encryption keys or to carry out operations with them.

The necessary steps to create an access certificate are available in our [Manage your OKMS access certificate](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/okms-certificate-management.md) guide.

 

### Use the OVHcloud KMS

Once your OVHcloud KMS is set up, there are two different ways to use it:

- Using the [Rest API](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/use-key-management-service.md), if you want to manually use the API to encrypt or sign your data.
- Using the [KMIP protocol](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/connect-product-using-kmip.md), if you want to connect any KMIP compatible product with your OVHcloud KMS.

 

## Go further

Browse all the [Key Management Service (KMS) guides](https://docs.us.ovhcloud.com/en/manage-and-operate/kms/landing-page-kms.md).

Browse the rest of the [OVHcloud US documentation](https://docs.us.ovhcloud.com/en/index.md) for guides on our other products and services.

Learn more about [Key Management Service](https://us.ovhcloud.com/identity-security-operations/key-management-service/) on the OVHcloud US website.