#### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure 'index')
### [Abblix\.Jwt\.Azure](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure 'Abblix\.Jwt\.Azure')

## ServiceCollectionExtensions Class

Registers the Azure Key Vault custodian for any host that signs or decrypts JSON Web Tokens, whether or not it
is an OpenID Provider\.

```csharp
public static class ServiceCollectionExtensions
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions
### Methods

## ServiceCollectionExtensions\.AddAzureCustodian\(this IServiceCollection, Action\<AzureKeyVaultOptions\>\) Method {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_)}

Registers Azure Key Vault as the custodian of the host's keys and opens the placement choice that completes
the wiring\. This call is only the transport: it registers the vault client and its credential\. Which keys
are used \- and whether their private halves ever enter this process \- is the placement call chained onto
the returned builder, which must follow: a custodian without one fails at startup rather than silently
falling back to whatever keys the configuration carries\. Chain both calls AFTER `AddJsonWebTokens`
\(the OIDC registration performs it\), which the placement call composes onto\.

```csharp
public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddAzureCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<Abblix.Jwt.Azure.AzureKeyVaultOptions> configureOptions);
```
#### Parameters

###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_).services}

The service collection to configure\.

###### `configureOptions` [System\.Action&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[AzureKeyVaultOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureKeyVaultOptions 'Abblix\.Jwt\.Azure\.AzureKeyVaultOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.AddAzureCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Azure.AzureKeyVaultOptions_).configureOptions}

Configures the vault URI and the service\-principal credentials\.

#### Returns
[IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder')  
The builder whose placement call completes the wiring\.

### Example

```csharp
services
    .AddAzureCustodian(azure => configuration.GetSection("Azure").Bind(azure))
    .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" });
```

## ServiceCollectionExtensions\.PersistRingToAzureBlob\(this IMintedKeysBuilder, Action\<AzureBlobKeyRingOptions\>\) Method {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_)}

Keeps the ring of minted keys in an Azure Blob Storage container, using the same credential the custodian
authenticates with\.

```csharp
public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToAzureBlob(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action<Abblix.Jwt.Azure.AzureBlobKeyRingOptions> configureOptions);
```
#### Parameters

###### `builder` [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_).builder}

The builder returned by `UseKeysInProcess`\.

###### `configureOptions` [System\.Action&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[AzureBlobKeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt-azure/Abblix.Jwt.Azure.AzureBlobKeyRingOptions 'Abblix\.Jwt\.Azure\.AzureBlobKeyRingOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Azure.ServiceCollectionExtensions.PersistRingToAzureBlob(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Azure.AzureBlobKeyRingOptions_).configureOptions}

Configures the blob service endpoint and the container\.

#### Returns
[Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')  
The service collection, for chaining\.

### Remarks
It hangs off the minting placement rather than the service collection because a ring belongs to it and to
no other: the placement where the vault holds every key has nothing to store\.

Blob rather than a Key Vault secret, though the vault is already configured: a secret write has no
conditional create, so two pods minting the same period would both succeed and each publish its own key. A
blob upload takes `If-None-Match: *`, which is the insert-if-absent the ring needs. What lands there
is a JWE sealed to the vault's key, so the container holds ciphertext and never a secret.