#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys')

## CustodianHeldKeys Class

Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves
where they never leave the custodian \(`UseKeysInCustodian`\)\. The keys belong to the operator: they are
already provisioned in the custodian, so this only names them\. Each algorithm is advertised on the published key
and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key\.

```csharp
public sealed record CustodianHeldKeys : System.IEquatable<Abblix.Jwt.ExternalKeys.CustodianHeldKeys>
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → CustodianHeldKeys

Implements [System\.IEquatable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')[CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.iequatable-1 'System\.IEquatable\`1')

### Remarks
A name here is the custodian's name for the LOGICAL key, not a published `kid`\. Every version of that key
is published under its own version\-qualified `kid` minted by the custodian \(Vault Transit
`<name>:<version>`, Azure Key Vault `<name>/<version>`\), which is what lets a
rotation overlap and routes each private operation back to the exact version that signed\. The bare name is the
published `kid` only for a custodian that does not version its keys and leaves the `kid` unset\.
### Properties

## CustodianHeldKeys\.EncryptionAlgorithm Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionAlgorithm}

The JWE key\-management algorithm the encryption key uses\. Has no effect unless
[EncryptionKeyName](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionKeyName 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys\.EncryptionKeyName') names a key\.

```csharp
public string EncryptionAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## CustodianHeldKeys\.EncryptionKeyName Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.EncryptionKeyName}

The custodian's name for the encryption key, whose versions are published and unwrapped with\. Name it when
anything encrypts to this provider: it both encrypts the provider's own tokens \(a service token configured
to be encrypted\) and decrypts inbound JWE a client sent, such as an encrypted request object or client
assertion, and its published half is what tells a client where to encrypt\.

```csharp
public string? EncryptionKeyName { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Optional, and unset means no encryption key is published at all, rather than a guessed name the custodian
may not hold: a signing\-only deployment is the common high\-assurance case\.

## CustodianHeldKeys\.SigningAlgorithm Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.SigningAlgorithm}

The JWS algorithm the signing key uses, for example `RS256`, `PS384` or `ES256` \(an EC one
needs a custodian key on the matching curve\)\.

```csharp
public string SigningAlgorithm { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

## CustodianHeldKeys\.SigningKeyName Property {#Abblix.Jwt.ExternalKeys.CustodianHeldKeys.SigningKeyName}

The custodian's name for the signing key, whose versions are published and signed with\. Required: a host
with no signing key cannot issue a token at all, so the compiler asks for it instead of a startup failure\.

```csharp
public string SigningKeyName { get; init; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')