{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/azure-keyvault-keys-ts",
  "version": "1.0.0",
  "name": "Azure Keyvault Keys Ts",
  "description": "Manage cryptographic keys using Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys). Use when creating, encrypting/decrypting, signing, or rotating keys.",
  "system_prompt_fragment": "# Azure Key Vault Keys SDK for TypeScript\n\nManage cryptographic keys with Azure Key Vault.\n\n## Installation\n\n```bash\n# Keys SDK\nnpm install @azure/keyvault-keys @azure/identity\n```\n\n## Environment Variables\n\n```bash\nKEY_VAULT_URL=https://<vault-name>.vault.azure.net\n# Or\nAZURE_KEYVAULT_NAME=<vault-name>\n```\n\n## Authentication\n\n```typescript\nimport { DefaultAzureCredential } from \"@azure/identity\";\nimport { KeyClient, CryptographyClient } from \"@azure/keyvault-keys\";\n\nconst credential = new DefaultAzureCredential();\nconst vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;\n\nconst keyClient = new KeyClient(vaultUrl, credential);\nconst secretClient = new SecretClient(vaultUrl, credential);\n```\n\n## Secrets Operations\n\n### Create/Set Secret\n\n```typescript\nconst secret = await secretClient.setSecret(\"MySecret\", \"secret-value\");\n\n// With attributes\nconst secretWithAttrs = await secretClient.setSecret(\"MySecret\", \"value\", {\n  enabled: true,\n  expiresOn: new Date(\"2025-12-31\"),\n  contentType: \"application/json\",\n  tags: { environment: \"production\" }\n});\n```\n\n### Get Secret\n\n```typescript\n// Get latest version\nconst secret = await secretClient.getSecret(\"MySecret\");\nconsole.log(secret.value);\n\n// Get specific version\nconst specificSecret = await secretClient.getSecret(\"MySecret\", {\n  version: secret.properties.version\n});\n```\n\n### List Secrets\n\n```typescript\nfor await (const secretProperties of secretClient.listPropertiesOfSecrets()) {\n  console.log(secretProperties.name);\n}\n\n// List versions\nfor await (const version of secretClient.listPropertiesOfSecretVersions(\"MySecret\")) {\n  console.log(version.version);\n}\n```\n\n### Delete Secret\n\n```typescript\n// Soft delete\nconst deletePoller = await secretClient.beginDeleteSecret(\"MySecret\");\nawait deletePoller.pollUntilDone();\n\n// Purge (permanent)\nawait secretClient.purgeDeletedSecret(\"MySecret\");\n\n// Recover\nconst recoverPoller = await secretClient.beginRecoverDeletedSecret(\"MySecret\");\nawait recoverPoller.pollUntilDone();\n```\n\n## Keys Operations\n\n### Create Keys\n\n```typescript\n// Generic key\nconst key = await keyClient.createKey(\"MyKey\", \"RSA\");\n\n// RSA key with size\nconst rsaKey = await keyClient.createRsaKey(\"MyRsaKey\", { keySize: 2048 });\n\n// Elliptic Curve key\nconst ecKey = await keyClient.createEcKey(\"MyEcKey\", { curve: \"P-256\" });\n\n// With attributes\nconst keyWithAttrs = await keyClient.createKey(\"MyKey\", \"RSA\", {\n  enabled: true,\n  expiresOn: new Date(\"2025-12-31\"),\n  tags: { purpose: \"encryption\" },\n  keyOps: [\"encrypt\", \"decrypt\", \"sign\", \"verify\"]\n});\n```\n\n### Get Key\n\n```typescript\nconst key = await keyClient.getKey(\"MyKey\");\nconsole.log(key.name, key.keyType);\n```\n\n### List Keys\n\n```typescript\nfor await (const keyProperties of keyClient.listPropertiesOfKeys()) {\n  console.log(keyProperties.name);\n}\n```\n\n### Rotate Key\n\n```typescript\n// Manual rotation\nconst rotatedKey = await keyClient.rotateKey(\"MyKey\");\n\n// Set rotation policy\nawait keyClient.updateKeyRotationPolicy(\"MyKey\", {\n  lifetimeActions: [{ action: \"Rotate\", timeBeforeExpiry: \"P30D\" }],\n  expiresIn: \"P90D\"\n});\n```\n\n### Delete Key\n\n```typescript\nconst deletePoller = await keyClient.beginDeleteKey(\"MyKey\");\nawait deletePoller.pollUntilDone();\n\n// Purge\nawait keyClient.purgeDeletedKey(\"MyKey\");\n```\n\n## Cryptographic Operations\n\n### Create CryptographyClient\n\n```typescript\nimport { CryptographyClient } from \"@azure/keyvault-keys\";\n\n// From key object\nconst cryptoClient = new CryptographyClient(key, credential);\n\n// From key ID\nconst cryptoClient = new CryptographyClient(key.id!, credential);\n```\n\n### Encrypt/Decrypt\n\n```typescript\n// Encrypt\nconst encryptResult = await cryptoClient.encrypt({\n  algorithm: \"RSA-OAEP\",\n  plaintext: Buffer.from(\"My secret message\")\n});\n\n// Decrypt\nconst decryptResult = await cryptoClient.decrypt({\n  algorithm: \"RSA-OAEP\",\n  ciphertext: encryptResult.result\n});\n\nconsole.log(decryptResult.result.toString());\n```\n\n### Sign/Verify\n\n```typescript\nimport { createHash } from \"node:crypto\";\n\n// Create digest\nconst hash = createHash(\"sha256\").update(\"My message\").digest();\n\n// Sign\nconst signResult = await cryptoClient.sign(\"RS256\", hash);\n\n// Verify\nconst verifyResult = await cryptoClient.verify(\"RS256\", hash, signResult.result);\nconsole.log(\"Valid:\", verifyResult.result);\n```\n\n### Wrap/Unwrap Keys\n\n```typescript\n// Wrap a key (encrypt it for storage)\nconst wrapResult = await cryptoClient.wrapKey(\"RSA-OAEP\", Buffer.from(\"key-material\"));\n\n// Unwrap\nconst unwrapResult = await cryptoClient.unwrapKey(\"RSA-OAEP\", wrapResult.result);\n```\n\n## Backup and Restore\n\n```typescript\n// Backup\nconst keyBackup = await keyClient.backupKey(\"MyKey\");\nconst secretBackup = await secretClient.backupSecret(\"MySecret\");\n\n// Restore (can restore to different vault)\nconst restoredKey = await keyClient.restoreKeyBackup(keyBackup!);\nconst restoredSecret = await secretClient.restoreSecretBackup(secretBackup!);\n```\n\n## Key Types\n\n```typescript\nimport {\n  KeyClient,\n  KeyVaultKey,\n  KeyProperties,\n  DeletedKey,\n  CryptographyClient,\n  KnownEncryptionAlgorithms,\n  KnownSignatureAlgorithms\n} from \"@azure/keyvault-keys\";\n\nimport {\n  SecretClient,\n  KeyVaultSecret,\n  SecretProperties,\n  DeletedSecret\n} from \"@azure/keyvault-secrets\";\n```\n\n## Error Handling\n\n```typescript\ntry {\n  const secret = await secretClient.getSecret(\"NonExistent\");\n} catch (error: any) {\n  if (error.code === \"SecretNotFound\") {\n    console.log(\"Secret does not exist\");\n  } else {\n    throw error;\n  }\n}\n```\n\n## Best Practices\n\n1. **Use DefaultAzureCredential** - Works across dev and production\n2. **Enable soft-delete** - Required for production vaults\n3. **Set expiration dates** - On both keys and secrets\n4. **Use key rotation policies** - Automate key rotation\n5. **Limit key operations** - Only grant needed operations (encrypt, sign, etc.)\n6. **Browser not supported** - These SDKs are Node.js only\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "devops"
  ],
  "category": "devops",
  "invocation": [
    "/azure-keyvault-keys-ts"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/azure-keyvault-keys-ts",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/azure-keyvault-keys-ts",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "devops"
  ],
  "lifecycle": "draft"
}