#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys')

## IKeyCustodianBuilder Interface

The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say
HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where
the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are
`UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK
unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and
the custodian only seals them\.

```csharp
public interface IKeyCustodianBuilder
```

Derived  
↳ [KeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.KeyCustodianBuilder')

### Remarks
A host that drops this builder without naming a placement fails at startup, rather than falling back silently to
whatever keys its configuration happens to carry \- which would leave a configured custodian, a clean log, and
local keys\.
### Properties

## IKeyCustodianBuilder\.Services Property {#Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder.Services}

The collection the placement call records its choice into\.

```csharp
Microsoft.Extensions.DependencyInjection.IServiceCollection Services { get; }
```

#### Property Value
[Microsoft\.Extensions\.DependencyInjection\.IServiceCollection](https://learn.microsoft.com/en-us/dotnet/api/microsoft.extensions.dependencyinjection.iservicecollection 'Microsoft\.Extensions\.DependencyInjection\.IServiceCollection')