#### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index')
### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure')

## KeyVaultClient Class

Thin wrapper over the Azure Key Vault SDK\. Signing and unwrapping run inside the vault against a key whose
private half never leaves it, so this type only moves bytes across the boundary\. The Azure SDK is pointed at
the host's [System\.Net\.Http\.IHttpClientFactory](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.ihttpclientfactory 'System\.Net\.Http\.IHttpClientFactory') transport \(like the Vault client\), so it inherits the host's HTTP
handlers, logging and pooling\. A [Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient](https://learn.microsoft.com/en-us/dotnet/api/azure.security.keyvault.keys.cryptography.cryptographyclient 'Azure\.Security\.KeyVault\.Keys\.Cryptography\.CryptographyClient') is cached per key name because creating one
resolves the key's metadata on first use\.

```csharp
public sealed class KeyVaultClient : Abblix.Jwt.ExternalKeys.IKeyCustodian
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyVaultClient

Implements [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian')
### Constructors

## KeyVaultClient\(ILogger\<KeyVaultClient\>, IOptions\<AzureKeyVaultOptions\>, HttpClient\) Constructor {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient)}

Creates the client for the vault named by [options](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).options 'Abblix\.Jwt\.Azure\.KeyVaultClient\.KeyVaultClient\(Microsoft\.Extensions\.Logging\.ILogger\<Abblix\.Jwt\.Azure\.KeyVaultClient\>, Microsoft\.Extensions\.Options\.IOptions\<Abblix\.Jwt\.Azure\.AzureKeyVaultOptions\>, System\.Net\.Http\.HttpClient\)\.options'), selecting a client\-secret
credential when the service\-principal fields are set, or the default Azure credential chain otherwise\.

```csharp
public KeyVaultClient(Microsoft.Extensions.Logging.ILogger<Abblix.Jwt.Azure.KeyVaultClient> logger, Microsoft.Extensions.Options.IOptions<Abblix.Jwt.Azure.AzureKeyVaultOptions> options, System.Net.Http.HttpClient httpClient);
```
#### Parameters

###### `logger` [Microsoft\.Extensions\.Logging\.ILogger&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1')[KeyVaultClient](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.KeyVaultClient 'Abblix\.Jwt\.Azure\.KeyVaultClient')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.logging.ilogger-1 'Microsoft\.Extensions\.Logging\.ILogger\`1') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).logger}

Logs an unwrap the vault rejected\.

###### `options` [Microsoft\.Extensions\.Options\.IOptions&lt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1')[AzureKeyVaultOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.options.ioptions-1 'Microsoft\.Extensions\.Options\.IOptions\`1') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).options}

The configured Azure Key Vault options\.

###### `httpClient` [System\.Net\.Http\.HttpClient](https://learn.microsoft.com/en-us/dotnet/api/system.net.http.httpclient 'System\.Net\.Http\.HttpClient') {#Abblix.Jwt.Azure.KeyVaultClient.KeyVaultClient(Microsoft.Extensions.Logging.ILogger_Abblix.Jwt.Azure.KeyVaultClient_,Microsoft.Extensions.Options.IOptions_Abblix.Jwt.Azure.AzureKeyVaultOptions_,System.Net.Http.HttpClient).httpClient}

The transport for every Key Vault call, supplied by `AddHttpClient` so the
            Azure SDK rides the host's HTTP pipeline\.
### Methods

## KeyVaultClient\.AgreeKeyAsync\(string, string, JsonWebKey, CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken)}

Derives the ECDH\-ES shared secret\. Azure Key Vault exposes no key\-agreement primitive, so this store does
not support ECDH\-ES; a store built on AWS KMS \(DeriveSharedSecret\) or a PKCS\#11 HSM \(CKM\_ECDH1\_DERIVE\) can\.

```csharp
public System.Threading.Tasks.Task<byte[]> AgreeKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebKey ephemeralPublicKey, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).keyId}

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).algorithm}

###### `ephemeralPublicKey` [JsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).ephemeralPublicKey}

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken).cancellationToken}

Implements [AgreeKeyAsync\(string, string, JsonWebKey, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.AgreeKeyAsync(string,string,Abblix.Jwt.JsonWebKey,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.AgreeKeyAsync\(System\.String,System\.String,Abblix\.Jwt\.JsonWebKey,System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')

## KeyVaultClient\.GetKeyVersionsAsync\(string, CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken)}

Enumerates every enabled version of the Key Vault key as a public\-only JWK \(RSA or EC, per the key type\),
each carrying the version\-specific `kid` \(`<name>/<version>`\) and the version's
creation time\. Key Vault lists version metadata but not the public key, so each version's key is fetched\.
Called at publication time, so JWKS publishing and signature verification run locally against the result
and never touch the vault on the hot path\. The versioned `kid` is a Key Vault key identifier, which
the crypto client turns straight back into a versioned URI for sign/unwrap, so no separate handle mapping
is needed\.

```csharp
public System.Collections.Generic.IAsyncEnumerable<Abblix.Jwt.KeyVersion> GetKeyVersionsAsync(string keyName, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `keyName` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken).keyName}

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.GetKeyVersionsAsync(string,System.Threading.CancellationToken).cancellationToken}

Implements [GetKeyVersionsAsync\(string, CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.GetKeyVersionsAsync(string,System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.GetKeyVersionsAsync\(System\.String,System\.Threading\.CancellationToken\)')

#### Returns
[System\.Collections\.Generic\.IAsyncEnumerable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')[KeyVersion](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.KeyVersion 'Abblix\.Jwt\.KeyVersion')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.collections.generic.iasyncenumerable-1 'System\.Collections\.Generic\.IAsyncEnumerable\`1')

## KeyVaultClient\.SignAsync\(string, string, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken)}

Signs the JWS signing input with a Key Vault key under the given JWS algorithm\. Key Vault hashes the data
and returns the raw signature already in JWS wire format \(R\|\|S for EC\)\.

```csharp
public System.Threading.Tasks.Task<byte[]> SignAsync(string keyId, string algorithm, byte[] data, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).keyId}

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).algorithm}

###### `data` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).data}

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.SignAsync(string,string,byte[],System.Threading.CancellationToken).cancellationToken}

Implements [SignAsync\(string, string, byte\[\], CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.SignAsync(string,string,byte[],System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.SignAsync\(System\.String,System\.String,System\.Byte\[\],System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')

## KeyVaultClient\.UnwrapKeyAsync\(string, string, JsonWebTokenHeader, byte\[\], CancellationToken\) Method {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken)}

Unwraps \(decrypts\) a CEK with a Key Vault RSA key under the given key\-management algorithm \(RSA\-OAEP\-256,
RSA\-OAEP or RSA1\_5\)\. Key Vault decrypts a raw JWE ciphertext directly\. Returns null when the vault rejects
the ciphertext, so a wrong key or tampered ciphertext is indistinguishable, which the seam's padding\-oracle
mitigation relies on\. The JWE header is unused: an RSA unwrap needs only the ciphertext\.

```csharp
public System.Threading.Tasks.Task<byte[]?> UnwrapKeyAsync(string keyId, string algorithm, Abblix.Jwt.JsonWebTokenHeader header, byte[] encryptedKey, System.Threading.CancellationToken cancellationToken);
```
#### Parameters

###### `keyId` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).keyId}

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).algorithm}

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).header}

###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).encryptedKey}

###### `cancellationToken` [System\.Threading\.CancellationToken](https://learn.microsoft.com/en-us/dotnet/api/system.threading.cancellationtoken 'System\.Threading\.CancellationToken') {#Abblix.Jwt.Azure.KeyVaultClient.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken).cancellationToken}

Implements [UnwrapKeyAsync\(string, string, JsonWebTokenHeader, byte\[\], CancellationToken\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian#Abblix.Jwt.ExternalKeys.IKeyCustodian.UnwrapKeyAsync(string,string,Abblix.Jwt.JsonWebTokenHeader,byte[],System.Threading.CancellationToken) 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian\.UnwrapKeyAsync\(System\.String,System\.String,Abblix\.Jwt\.JsonWebTokenHeader,System\.Byte\[\],System\.Threading\.CancellationToken\)')

#### Returns
[System\.Threading\.Tasks\.Task&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.threading.tasks.task-1 'System\.Threading\.Tasks\.Task\`1')