What is the difference between a key and a secret in Azure Key Vault?

Question

What is the difference between a key and a secret in Azure Key Vault?

Note: As we migrate from MSDN, this question has been posted by an Azure Cloud Engineer as a frequently asked question

Source: Key Vault

Answer 1

A secret is anything that you want to tightly control access to, such as API keys, passwords, or certificates.

A key is a cryptographic key represented as a JSON Web Key [JWK] object. Key Vault supports RSA and Elliptic Curve Keys only.

Source: Key Vault

Answer 2

Example

Keys:

let's say you need to encrypt sensitive user data (like SSN) before storing it in your database to ensure confidentiality. You would go for keys in Azure Key Vault. This key would be used to encrypt and decrypt the user data and you NO need to worry about the safety of these keys.

Secrets:

Say, your web application needs to connect to an external API that requires an API key for authentication. You would store this API key as a secret in Azure Key Vault, allowing your application to securely retrieve it when making API requests. whenever the vendor changes the key, you can update it in Secrets.

Hope this helps you.

Answer 3

Also one important difference, is that a Key can never leave the Key-Vault boundary. Even the owner of the key vault cannot see or retrieve the clear "key". However, that is not the case with "secrets".

Answer 4

It would be nice if some one can provide an example for Keys and Secrets