共用方式為

KeyClient class

套件:
@azure/keyvault-keys

KeyClient 提供方法來管理 Azure Key Vault 中的 KeyVaultKey。 用戶端支援建立、擷取、更新、刪除、清除、備份、還原及列出KeyVaultKeys。 用戶端也支援針對已啟用虛刪除的 Azure Key Vault 列出 DeletedKey。

建構函式

KeyClient(string, TokenCredential, KeyClientOptions)

建立 KeyClient 的實例。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

// Build the URL to reach your key vault
const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`; // or `https://${vaultName}.managedhsm.azure.net` for managed HSM.

// Lastly, create our keys client and connect to the service
const client = new KeyClient(url, credential);

屬性

vaultUrl

保存庫的基底 URL

方法

backupKey(string, BackupKeyOptions)

要求將指定金鑰的備份下載到用戶端。 所有版本的金鑰都會下載。 此作業需要金鑰/備份許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

備份指定的索引鍵。
beginDeleteKey(string, BeginDeleteKeyOptions)

刪除作業適用於儲存在 Azure Key Vault 中的任何密鑰。 無法刪除個別版本的金鑰，一次只能刪除指定金鑰的所有版本。

此函式會傳回長時間執行的作業輪詢器，可讓您無限期等候直到刪除密鑰為止。

此作業需要金鑰/刪除許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const poller = await client.beginDeleteKey(keyName);
await poller.pollUntilDone();

從指定的金鑰保存庫刪除金鑰。
beginRecoverDeletedKey(string, BeginRecoverDeletedKeyOptions)

復原指定保存庫中已刪除的金鑰。 此作業只能在已啟用虛刪除的保存庫上執行。

此函式會傳回長時間執行的作業輪詢器，可讓您無限期等候，直到復原已刪除的密鑰為止。

此作業需要金鑰/復原許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

const recoverPoller = await client.beginRecoverDeletedKey(keyName);
const recoveredKey = await recoverPoller.pollUntilDone();

將已刪除的金鑰復原至最新版本。
createEcKey(string, CreateEcKeyOptions)

createEcKey 方法會在 Azure Key Vault 中建立新的橢圓曲線密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createEcKey(keyName, { curve: "P-256" });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。
createKey(string, string, CreateKeyOptions)

建立金鑰作業可用來在 Azure Key Vault 中建立任何密鑰類型。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createKey(keyName, "RSA");
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。
createOctKey(string, CreateOctKeyOptions)

createOctKey 方法會在 Azure Key Vault 中建立新的 OCT 密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createOctKey("MyKey", { hsm: true });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。
createRsaKey(string, CreateRsaKeyOptions)

createRSAKey 方法會在 Azure Key Vault 中建立新的 RSA 密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createRsaKey("MyKey", { keySize: 2048 });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。
getCryptographyClient(string, GetCryptographyClientOptions)

取得指定金鑰的 CryptographyClient。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

// Get a cryptography client for a given key
const cryptographyClient = client.getCryptographyClient("MyKey");
getDeletedKey(string, GetDeletedKeyOptions)

getDeletedKey 方法會傳回指定的已刪除索引鍵及其屬性。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

await client.getDeletedKey(keyName);

取得指定的已刪除索引鍵。
getKey(string, GetKeyOptions)

getKey 方法會取得指定的密鑰，並適用於儲存在 Azure Key Vault 中的任何密鑰。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKey(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKey(keyName, { version: latestKey.properties.version! });
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

從指定的金鑰保存庫取得指定的金鑰。
getKeyAttestation(string, GetKeyAttestationOptions)

getKeyAttestation 方法會取得指定的密鑰及其證明 Blob，並適用於儲存在 Azure Key Vault 受控 HSM 中的任何密鑰。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT MANAGED HSM NAME>";
const url = `https://${vaultName}.managedhsm.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKeyAttestation(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKeyAttestation(keyName, {
  version: latestKey.properties.version!,
});
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

從指定的金鑰保存庫取得指定的金鑰。
getKeyRotationPolicy(string, GetKeyRotationPolicyOptions)

取得 Key Vault 金鑰的輪替原則。 根據預設，所有金鑰都有原則會在到期前 30 天通知。

此作業需要金鑰/取得許可權。 範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.getKeyRotationPolicy(keyName);
getRandomBytes(number, GetRandomBytesOptions)

取得要求的位元組數目，其中包含來自Managed HSM 的隨機值。 此作業需要managedHsm/rng許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const bytes = await client.getRandomBytes(10);
importKey(string, JsonWebKey, ImportKeyOptions)

匯入金鑰作業可用來將任何金鑰類型匯入 Azure Key Vault。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 此作業需要金鑰/匯入許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const jsonWebKey = {
  kty: "RSA",
  kid: "test-key-123",
  use: "sig",
  alg: "RS256",
  n: new Uint8Array([112, 34, 56, 98, 123, 244, 200, 99]),
  e: new Uint8Array([1, 0, 1]),
  d: new Uint8Array([45, 67, 89, 23, 144, 200, 76, 233]),
  p: new Uint8Array([34, 89, 100, 77, 204, 56, 29, 77]),
  q: new Uint8Array([78, 99, 201, 45, 188, 34, 67, 90]),
  dp: new Uint8Array([23, 45, 78, 56, 200, 144, 32, 67]),
  dq: new Uint8Array([12, 67, 89, 144, 99, 56, 23, 45]),
  qi: new Uint8Array([78, 90, 45, 201, 34, 67, 120, 55]),
};

const result = await client.importKey("MyKey", jsonWebKey);

匯入外部建立的金鑰、儲存金鑰，並將金鑰參數和屬性傳回用戶端。
listDeletedKeys(ListDeletedKeysOptions)

反覆運算保存庫中已刪除的金鑰。 回應中會提供完整的金鑰標識碼和屬性。 索引鍵不會傳回任何值。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保存庫中的所有金鑰
listPropertiesOfKeys(ListPropertiesOfKeysOptions)

反覆運算保存庫中所有金鑰的最新版本。 回應中會提供完整的金鑰標識碼和屬性。 索引鍵不會傳回任何值。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保存庫中的所有金鑰
listPropertiesOfKeyVersions(string, ListPropertiesOfKeyVersionsOptions)

在保存庫中反覆運算指定金鑰的所有版本。 回應中會提供完整的金鑰標識碼、屬性和標籤。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}
purgeDeletedKey(string, PurgeDeletedKeyOptions)

清除刪除的金鑰作業會永久移除金鑰，而無法復原。 此作業只能在已啟用虛刪除的保存庫上啟用。 此作業需要金鑰/清除許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

await client.purgeDeletedKey(keyName);

永久刪除指定的索引鍵。
releaseKey(string, string, ReleaseKeyOptions)

從受控 HSM 釋放金鑰。

發行金鑰作業適用於所有金鑰類型。 作業需要金鑰標示為可匯出，以及金鑰/發行許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.releaseKey("myKey", "<attestation-target>");
restoreKeyBackup(Uint8Array, RestoreKeyBackupOptions)

將備份的金鑰及其所有版本還原至保存庫。 此作業需要金鑰/還原許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

const key = await client.restoreKeyBackup(backupContents);

將備份的金鑰還原至保存庫。
rotateKey(string, RotateKeyOptions)

藉由產生新版本的金鑰，根據金鑰原則輪替金鑰。 此作業需要金鑰/輪替許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

// Set the key's automated rotation policy to rotate the key 30 days before expiry.
const policy = await client.updateKeyRotationPolicy(keyName, {
  lifetimeActions: [
    {
      action: "Rotate",
      timeBeforeExpiry: "P30D",
    },
  ],
  // You may also specify the duration after which any newly rotated key will expire.
  // In this case, any new key versions will expire after 90 days.
  expiresIn: "P90D",
});

// You can get the current key rotation policy of a given key by calling the getKeyRotationPolicy method.
const currentPolicy = await client.getKeyRotationPolicy(keyName);

// Finally, you can rotate a key on-demand by creating a new version of the given key.
const rotatedKey = await client.rotateKey(keyName);
updateKeyProperties(string, string, UpdateKeyPropertiesOptions)

updateKeyProperties 方法會變更現有預存密鑰的指定屬性。 要求中未指定的屬性會保持不變。 無法變更索引鍵本身的值。 此作業需要金鑰/設定許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新與指定金鑰保存庫中指定之金鑰相關聯的屬性。
updateKeyProperties(string, UpdateKeyPropertiesOptions)

updateKeyProperties 方法會變更現有預存密鑰最新版本的指定屬性。 要求中未指定的屬性會保持不變。 無法變更索引鍵本身的值。 此作業需要金鑰/設定許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新與指定金鑰保存庫中指定之金鑰相關聯的屬性。
updateKeyRotationPolicy(string, KeyRotationPolicyProperties, UpdateKeyRotationPolicyOptions)

更新 Key Vault 金鑰的輪替原則。 此作業需要金鑰/更新許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const myPolicy = await client.getKeyRotationPolicy(keyName);

const setPolicy = await client.updateKeyRotationPolicy(keyName, myPolicy);

建構函式詳細資料

KeyClient(string, TokenCredential, KeyClientOptions)

建立 KeyClient 的實例。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

// Build the URL to reach your key vault
const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`; // or `https://${vaultName}.managedhsm.azure.net` for managed HSM.

// Lastly, create our keys client and connect to the service
const client = new KeyClient(url, credential);

new KeyClient(vaultUrl: string, credential: TokenCredential, pipelineOptions?: KeyClientOptions)

參數

vaultUrl

string

Key Vault 的 URL。 它應該有這個圖形：https://${your-key-vault-name}.vault.azure.net。 您應該驗證此 URL 參考有效的 Key Vault 或受控 HSM 資源。 如需詳細資訊，請參閱 https://aka.ms/azsdk/blog/vault-uri。

credential
TokenCredential

對象，實作用來驗證服務要求 TokenCredential 介面。 使用 @azure/identity 套件來建立符合您需求的認證。

pipelineOptions
KeyClientOptions

用來設定 Key Vault API 要求的管線選項。 請省略此參數以使用預設管線組態。

屬性詳細資料

vaultUrl

保存庫的基底 URL

vaultUrl: string

屬性值

string

方法詳細資料

backupKey(string, BackupKeyOptions)

要求將指定金鑰的備份下載到用戶端。 所有版本的金鑰都會下載。 此作業需要金鑰/備份許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

備份指定的索引鍵。

function backupKey(name: string, options?: BackupKeyOptions): Promise<undefined | Uint8Array>

參數

name

string

索引鍵的名稱。

options
BackupKeyOptions

選擇性參數。

傳回

Promise<undefined | Uint8Array>

beginDeleteKey(string, BeginDeleteKeyOptions)

刪除作業適用於儲存在 Azure Key Vault 中的任何密鑰。 無法刪除個別版本的金鑰，一次只能刪除指定金鑰的所有版本。

此函式會傳回長時間執行的作業輪詢器，可讓您無限期等候直到刪除密鑰為止。

此作業需要金鑰/刪除許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const poller = await client.beginDeleteKey(keyName);
await poller.pollUntilDone();

從指定的金鑰保存庫刪除金鑰。

function beginDeleteKey(name: string, options?: BeginDeleteKeyOptions): Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

參數

name

string

索引鍵的名稱。

options
BeginDeleteKeyOptions

選擇性參數。

傳回

Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

beginRecoverDeletedKey(string, BeginRecoverDeletedKeyOptions)

復原指定保存庫中已刪除的金鑰。 此作業只能在已啟用虛刪除的保存庫上執行。

此函式會傳回長時間執行的作業輪詢器，可讓您無限期等候，直到復原已刪除的密鑰為止。

此作業需要金鑰/復原許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

const recoverPoller = await client.beginRecoverDeletedKey(keyName);
const recoveredKey = await recoverPoller.pollUntilDone();

將已刪除的金鑰復原至最新版本。

function beginRecoverDeletedKey(name: string, options?: BeginRecoverDeletedKeyOptions): Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

參數

name

string

已刪除金鑰的名稱。

options
BeginRecoverDeletedKeyOptions

選擇性參數。

傳回

Promise<PollerLike<PollOperationState<DeletedKey>, DeletedKey>>

createEcKey(string, CreateEcKeyOptions)

createEcKey 方法會在 Azure Key Vault 中建立新的橢圓曲線密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createEcKey(keyName, { curve: "P-256" });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。

function createEcKey(name: string, options?: CreateEcKeyOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
CreateEcKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

createKey(string, string, CreateKeyOptions)

建立金鑰作業可用來在 Azure Key Vault 中建立任何密鑰類型。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createKey(keyName, "RSA");
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。

function createKey(name: string, keyType: string, options?: CreateKeyOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

keyType

string

索引鍵的類型。 下列其中一項：『EC』、『EC-HSM』、『RSA』、『RSA-HSM』、『oct』。

options
CreateKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

createOctKey(string, CreateOctKeyOptions)

createOctKey 方法會在 Azure Key Vault 中建立新的 OCT 密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createOctKey("MyKey", { hsm: true });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。

function createOctKey(name: string, options?: CreateOctKeyOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
CreateOctKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

createRsaKey(string, CreateRsaKeyOptions)

createRSAKey 方法會在 Azure Key Vault 中建立新的 RSA 密鑰。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 它需要金鑰/建立許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";
const result = await client.createRsaKey("MyKey", { keySize: 2048 });
console.log("result: ", result);

建立新的金鑰、儲存金鑰，然後將金鑰參數和屬性傳回給用戶端。

function createRsaKey(name: string, options?: CreateRsaKeyOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
CreateRsaKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

getCryptographyClient(string, GetCryptographyClientOptions)

取得指定金鑰的 CryptographyClient。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

// Get a cryptography client for a given key
const cryptographyClient = client.getCryptographyClient("MyKey");

function getCryptographyClient(keyName: string, options?: GetCryptographyClientOptions): CryptographyClient

參數

keyName

string

options
GetCryptographyClientOptions

傳回

CryptographyClient

getDeletedKey(string, GetDeletedKeyOptions)

getDeletedKey 方法會傳回指定的已刪除索引鍵及其屬性。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

await client.getDeletedKey(keyName);

取得指定的已刪除索引鍵。

function getDeletedKey(name: string, options?: GetDeletedKeyOptions): Promise<DeletedKey>

參數

name

string

索引鍵的名稱。

options
GetDeletedKeyOptions

選擇性參數。

傳回

Promise<DeletedKey>

getKey(string, GetKeyOptions)

getKey 方法會取得指定的密鑰，並適用於儲存在 Azure Key Vault 中的任何密鑰。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKey(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKey(keyName, { version: latestKey.properties.version! });
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

從指定的金鑰保存庫取得指定的金鑰。

function getKey(name: string, options?: GetKeyOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
GetKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

getKeyAttestation(string, GetKeyAttestationOptions)

getKeyAttestation 方法會取得指定的密鑰及其證明 Blob，並適用於儲存在 Azure Key Vault 受控 HSM 中的任何密鑰。 此作業需要金鑰/取得許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT MANAGED HSM NAME>";
const url = `https://${vaultName}.managedhsm.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const latestKey = await client.getKeyAttestation(keyName);
console.log(`Latest version of the key ${keyName}: `, latestKey);

const specificKey = await client.getKeyAttestation(keyName, {
  version: latestKey.properties.version!,
});
console.log(`The key ${keyName} at the version ${latestKey.properties.version!}: `, specificKey);

從指定的金鑰保存庫取得指定的金鑰。

function getKeyAttestation(name: string, options?: GetKeyAttestationOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
GetKeyAttestationOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

getKeyRotationPolicy(string, GetKeyRotationPolicyOptions)

取得 Key Vault 金鑰的輪替原則。 根據預設，所有金鑰都有原則會在到期前 30 天通知。

此作業需要金鑰/取得許可權。 範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.getKeyRotationPolicy(keyName);

function getKeyRotationPolicy(keyName: string, options?: GetKeyRotationPolicyOptions): Promise<KeyRotationPolicy>

參數

keyName

string

索引鍵的名稱。

options
GetKeyRotationPolicyOptions

選擇性參數。

傳回

Promise<KeyRotationPolicy>

getRandomBytes(number, GetRandomBytesOptions)

取得要求的位元組數目，其中包含來自Managed HSM 的隨機值。 此作業需要managedHsm/rng許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const bytes = await client.getRandomBytes(10);

function getRandomBytes(count: number, options?: GetRandomBytesOptions): Promise<Uint8Array>

參數

count

number

要包含 1 到 128 之間的位元元數目。

options
GetRandomBytesOptions

選擇性參數。

傳回

Promise<Uint8Array>

importKey(string, JsonWebKey, ImportKeyOptions)

匯入金鑰作業可用來將任何金鑰類型匯入 Azure Key Vault。 如果具名密鑰已經存在，Azure Key Vault 會建立新版本的密鑰。 此作業需要金鑰/匯入許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const jsonWebKey = {
  kty: "RSA",
  kid: "test-key-123",
  use: "sig",
  alg: "RS256",
  n: new Uint8Array([112, 34, 56, 98, 123, 244, 200, 99]),
  e: new Uint8Array([1, 0, 1]),
  d: new Uint8Array([45, 67, 89, 23, 144, 200, 76, 233]),
  p: new Uint8Array([34, 89, 100, 77, 204, 56, 29, 77]),
  q: new Uint8Array([78, 99, 201, 45, 188, 34, 67, 90]),
  dp: new Uint8Array([23, 45, 78, 56, 200, 144, 32, 67]),
  dq: new Uint8Array([12, 67, 89, 144, 99, 56, 23, 45]),
  qi: new Uint8Array([78, 90, 45, 201, 34, 67, 120, 55]),
};

const result = await client.importKey("MyKey", jsonWebKey);

匯入外部建立的金鑰、儲存金鑰，並將金鑰參數和屬性傳回用戶端。

function importKey(name: string, key: JsonWebKey, options?: ImportKeyOptions): Promise<KeyVaultKey>

參數

name

string

匯入金鑰的名稱。

key
JsonWebKey

JSON Web 金鑰。

options
ImportKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

listDeletedKeys(ListDeletedKeysOptions)

反覆運算保存庫中已刪除的金鑰。 回應中會提供完整的金鑰標識碼和屬性。 索引鍵不會傳回任何值。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保存庫中的所有金鑰

function listDeletedKeys(options?: ListDeletedKeysOptions): PagedAsyncIterableIterator<DeletedKey, DeletedKey[], PageSettings>

參數

options
ListDeletedKeysOptions

選擇性參數。

傳回

PagedAsyncIterableIterator<DeletedKey, DeletedKey[], PageSettings>

listPropertiesOfKeys(ListPropertiesOfKeysOptions)

反覆運算保存庫中所有金鑰的最新版本。 回應中會提供完整的金鑰標識碼和屬性。 索引鍵不會傳回任何值。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

列出保存庫中的所有金鑰

function listPropertiesOfKeys(options?: ListPropertiesOfKeysOptions): PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

參數

options
ListPropertiesOfKeysOptions

選擇性參數。

傳回

PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

listPropertiesOfKeyVersions(string, ListPropertiesOfKeyVersionsOptions)

在保存庫中反覆運算指定金鑰的所有版本。 回應中會提供完整的金鑰標識碼、屬性和標籤。 此作業需要金鑰/列表許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

for await (const keyProperties of client.listPropertiesOfKeys()) {
  console.log("Key properties: ", keyProperties);
}

for await (const deletedKey of client.listDeletedKeys()) {
  console.log("Deleted: ", deletedKey);
}

for await (const versionProperties of client.listPropertiesOfKeyVersions(keyName)) {
  console.log("Version properties: ", versionProperties);
}

function listPropertiesOfKeyVersions(name: string, options?: ListPropertiesOfKeyVersionsOptions): PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

參數

name

string

要擷取版本的金鑰名稱

options
ListPropertiesOfKeyVersionsOptions

選擇性參數。

傳回

PagedAsyncIterableIterator<KeyProperties, KeyProperties[], PageSettings>

purgeDeletedKey(string, PurgeDeletedKeyOptions)

清除刪除的金鑰作業會永久移除金鑰，而無法復原。 此作業只能在已啟用虛刪除的保存庫上啟用。 此作業需要金鑰/清除許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const deletePoller = await client.beginDeleteKey(keyName);
await deletePoller.pollUntilDone();

await client.purgeDeletedKey(keyName);

永久刪除指定的索引鍵。

function purgeDeletedKey(name: string, options?: PurgeDeletedKeyOptions): Promise<void>

參數

name

string

索引鍵的名稱。

options
PurgeDeletedKeyOptions

選擇性參數。

傳回

Promise<void>

releaseKey(string, string, ReleaseKeyOptions)

從受控 HSM 釋放金鑰。

發行金鑰作業適用於所有金鑰類型。 作業需要金鑰標示為可匯出，以及金鑰/發行許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.releaseKey("myKey", "<attestation-target>");

function releaseKey(name: string, targetAttestationToken: string, options?: ReleaseKeyOptions): Promise<ReleaseKeyResult>

參數

name

string

索引鍵的名稱。

targetAttestationToken

string

金鑰發行目標的證明判斷提示。

options
ReleaseKeyOptions

選擇性參數。

傳回

Promise<ReleaseKeyResult>

restoreKeyBackup(Uint8Array, RestoreKeyBackupOptions)

將備份的金鑰及其所有版本還原至保存庫。 此作業需要金鑰/還原許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const backupContents = await client.backupKey(keyName);

const key = await client.restoreKeyBackup(backupContents);

將備份的金鑰還原至保存庫。

function restoreKeyBackup(backup: Uint8Array, options?: RestoreKeyBackupOptions): Promise<KeyVaultKey>

參數

backup

Uint8Array

與金鑰組合相關聯的備份 Blob。

options
RestoreKeyBackupOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

rotateKey(string, RotateKeyOptions)

藉由產生新版本的金鑰，根據金鑰原則輪替金鑰。 此作業需要金鑰/輪替許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

// Set the key's automated rotation policy to rotate the key 30 days before expiry.
const policy = await client.updateKeyRotationPolicy(keyName, {
  lifetimeActions: [
    {
      action: "Rotate",
      timeBeforeExpiry: "P30D",
    },
  ],
  // You may also specify the duration after which any newly rotated key will expire.
  // In this case, any new key versions will expire after 90 days.
  expiresIn: "P90D",
});

// You can get the current key rotation policy of a given key by calling the getKeyRotationPolicy method.
const currentPolicy = await client.getKeyRotationPolicy(keyName);

// Finally, you can rotate a key on-demand by creating a new version of the given key.
const rotatedKey = await client.rotateKey(keyName);

function rotateKey(name: string, options?: RotateKeyOptions): Promise<KeyVaultKey>

參數

name

string

要輪替的金鑰名稱。

options
RotateKeyOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

updateKeyProperties(string, string, UpdateKeyPropertiesOptions)

updateKeyProperties 方法會變更現有預存密鑰的指定屬性。 要求中未指定的屬性會保持不變。 無法變更索引鍵本身的值。 此作業需要金鑰/設定許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新與指定金鑰保存庫中指定之金鑰相關聯的屬性。

function updateKeyProperties(name: string, keyVersion: string, options?: UpdateKeyPropertiesOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

keyVersion

string

金鑰的版本。

options
UpdateKeyPropertiesOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

updateKeyProperties(string, UpdateKeyPropertiesOptions)

updateKeyProperties 方法會變更現有預存密鑰最新版本的指定屬性。 要求中未指定的屬性會保持不變。 無法變更索引鍵本身的值。 此作業需要金鑰/設定許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const result = await client.createKey(keyName, "RSA");
await client.updateKeyProperties(keyName, result.properties.version, {
  enabled: false,
});

更新與指定金鑰保存庫中指定之金鑰相關聯的屬性。

function updateKeyProperties(name: string, options?: UpdateKeyPropertiesOptions): Promise<KeyVaultKey>

參數

name

string

索引鍵的名稱。

options
UpdateKeyPropertiesOptions

選擇性參數。

傳回

Promise<KeyVaultKey>

updateKeyRotationPolicy(string, KeyRotationPolicyProperties, UpdateKeyRotationPolicyOptions)

更新 Key Vault 金鑰的輪替原則。 此作業需要金鑰/更新許可權。

範例用法：

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();

const vaultName = "<YOUR KEYVAULT NAME>";
const url = `https://${vaultName}.vault.azure.net`;

const client = new KeyClient(url, credential);

const keyName = "MyKeyName";

const myPolicy = await client.getKeyRotationPolicy(keyName);

const setPolicy = await client.updateKeyRotationPolicy(keyName, myPolicy);

function updateKeyRotationPolicy(keyName: string, policy: KeyRotationPolicyProperties, options?: UpdateKeyRotationPolicyOptions): Promise<KeyRotationPolicy>

參數

keyName

string

索引鍵的名稱。

policy
KeyRotationPolicyProperties
options
UpdateKeyRotationPolicyOptions

選擇性參數。

傳回

Promise<KeyRotationPolicy>