Keys and signatures

​

Choose who manages keys

​

Key workflow

Choose a supported algorithm
        ↓
Create a key in the correct account context
        ↓
Persist the returned key identifier
        ↓
Associate it with the identity or signing workflow
        ↓
Verify the resulting signature or signed object

​

Application rules

• Keep passwords, JWTs, key passwords, private keys, and signing secrets out of source control and logs.
• Persist returned identifiers rather than parsing them from display text.
• Make the actor, key, payload, and intended signing purpose explicit.
• Do not claim legal effect or non-repudiation solely because bytes have a valid cryptographic signature; the identity, authorization, contract, policy, and verification context also matter.
• Treat retries carefully. A signing operation may have effects that should not be duplicated unless idempotency is explicitly documented.

​

Build with signatures

• Create cryptographic keys
• Digital signatures
• Cryptography reference