#### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault 'index')
### [Abblix\.Jwt\.Vault](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault 'Abblix\.Jwt\.Vault')

## ServiceCollectionExtensions Class

Registers the HashiCorp Vault / OpenBao Transit custodian for any host that signs or decrypts JSON Web Tokens,
whether or not it is an OpenID Provider\.

```csharp
public static class ServiceCollectionExtensions
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → ServiceCollectionExtensions
### Methods

## ServiceCollectionExtensions\.AddVaultCustodian\(this IServiceCollection, Action\<VaultTransitOptions\>\) Method {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_)}

Registers Vault / OpenBao Transit as the custodian of the host's keys and opens the placement choice that
completes the wiring\. This call is only the transport: it points a client at the Vault server and carries
the auth token\. Which keys are used \- and whether their private halves ever enter this process \- is the
placement call chained onto the returned builder, which must follow: a custodian without one fails at
startup rather than silently falling back to whatever keys the configuration carries\. Chain both calls
AFTER `AddJsonWebTokens` \(the OIDC registration performs it\), which the placement call composes onto\.

```csharp
public static Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder AddVaultCustodian(this Microsoft.Extensions.DependencyInjection.IServiceCollection services, System.Action<Abblix.Jwt.Vault.VaultTransitOptions> configureOptions);
```
#### Parameters

###### `services` [Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_).services}

The service collection to configure\.

###### `configureOptions` [System\.Action&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[VaultTransitOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultTransitOptions 'Abblix\.Jwt\.Vault\.VaultTransitOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.AddVaultCustodian(thisMicrosoft.Extensions.DependencyInjection.IServiceCollection,System.Action_Abblix.Jwt.Vault.VaultTransitOptions_).configureOptions}

Configures the Vault address, auth token and Transit mount\.

#### Returns
[IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder')  
The builder whose placement call completes the wiring\.

### Example

```csharp
services
    .AddVaultCustodian(vault => configuration.GetSection("Vault").Bind(vault))
    .UseKeysInCustodian(new CustodianHeldKeys { SigningKeyName = "oidc-sign" });
```

## ServiceCollectionExtensions\.PersistRingToVaultKeyValue\(this IMintedKeysBuilder, Action\<VaultKeyValueOptions\>\) Method {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_)}

Keeps the ring of minted keys in this Vault's KV version 2 engine, on the same server that holds the key
protecting them\.

```csharp
public static Microsoft.Extensions.DependencyInjection.IServiceCollection PersistRingToVaultKeyValue(this Abblix.Jwt.ExternalKeys.IMintedKeysBuilder builder, System.Action<Abblix.Jwt.Vault.VaultKeyValueOptions>? configureOptions=null);
```
#### Parameters

###### `builder` [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_).builder}

The builder returned by `UseKeysInProcess`\.

###### `configureOptions` [System\.Action&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1')[VaultKeyValueOptions](https://www.abblix.com/en/docs/api/abblix-jwt-vault/Abblix.Jwt.Vault.VaultKeyValueOptions 'Abblix\.Jwt\.Vault\.VaultKeyValueOptions')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.action-1 'System\.Action\`1') {#Abblix.Jwt.Vault.ServiceCollectionExtensions.PersistRingToVaultKeyValue(thisAbblix.Jwt.ExternalKeys.IMintedKeysBuilder,System.Action_Abblix.Jwt.Vault.VaultKeyValueOptions_).configureOptions}

Configures the KV mount and the path the ring lives under\.

#### Returns
[Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')  
The service collection, for chaining\.

### Remarks
It hangs off the minting placement rather than the service collection because a ring belongs to it and to
no other: the placement where the custodian holds every key has nothing to store\.

The engine must be KV v2. Its `cas=0` write is the insert-if-absent the ring is built on, and it is
what makes exactly one pod mint a period without a lock service. What lands there is a JWE the server
sealed to the custodian's key, so the engine holds ciphertext and never a secret.