# KeyVault

For general information on resource management, see Resource Management.

## Create the client

The following code creates an instance of the client.

See Resource Management Authentication for details on handling Azure Active Directory authentication with the Python SDK, and creating a `Credentials` instance.

Important

You must specify resource=”https://vault.azure.net” while authenticating to get a valid token

    from azure.keyvault import KeyVaultClient
    from azure.common.credentials import UserPassCredentials

    # See above for details on creating different types of AAD credentials
    credentials = UserPassCredentials(
        'user@domain.com',  # Your user
        'my_password',      # Your password
        resource='https://vault.azure.net'
    )

    client = KeyVaultClient(
        credentials
    )

## Access policies

Some operations require the correct access policies for your credentials.

If you get an “Unauthorized” error, please add the correct access policies to this credentials using the Azure Portal, the Azure CLI or the Key Vault Management SDK itself

## Example

`KEY_VAULT_URI` is the base url of your keyvault. Eg. https://myvault.vault.azure.net

    # Create a key
    key_bundle = client.create_key(KEY_VAULT_URI, 'FirstKey', 'RSA')
    key_id = KeyVaultId.parse_key_id(key_bundle.key.kid)

    # Update a key without version
    client.update_key(key_id.vault, key_id.name, key_id.version_none, key_attributes={'enabled': False})

    # Update a key with version
    client.update_key(key_id.vault, key_id.name, key_id.version, key_attributes={'enabled': False})

    # Print a list of versions for a key
    versions = client.get_key_versions(KEY_VAULT_URI, 'FirstKey')
    for version in versions:
        print(version.kid)  # https://myvault.vault.azure.net/keys/FirstKey/000102030405060708090a0b0c0d0e0f

    # Read a key without version
    client.get_key(key_id.vault, key_id.name, key_id.version_none)

    # Read a key with version
    client.get_key(key_id.vault, key_id.name, key_id.version)

    # Delete a key
    client.delete_key(KEY_VAULT_URI, 'FirstKey')

    # Create a secret
    secret_bundle = client.set_secret(KEY_VAULT_URI, 'FirstSecret', 'Hush, that is secret!!')
    secret_id = KeyVaultId.parse_secret_id(secret_bundle.id)

    # Update a secret without version
    client.update_secret(secret_id.vault, secret_id.name, secret_id.version_none, secret_attributes={'enabled': False})

    # Update a secret with version
    client.update_key(secret_id.vault, secret_id.name, secret_id.version, secret_attributes={'enabled': False})

    # Print a list of versions for a secret
    versions = client.get_secret_versions(KEY_VAULT_URI, 'FirstSecret')
    for version in versions:
        print(version.id)  # https://myvault.vault.azure.net/secrets/FirstSecret/000102030405060708090a0b0c0d0e0f

    # Read a secret without version
    client.get_secret(secret_id.vault, secret_id.name, secret_id.version_none)

    # Read a secret with version
    client.get_secret(secret_id.vault, secret_id.name, secret_id.version)

    # Delete a secret
    client.delete_secret(KEY_VAULT_URI, 'FirstSecret')