#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.ExternalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys 'Abblix\.Jwt\.ExternalKeys')

## KeyPlacementChoice Class

Records where the host chose to keep its private keys for its registered custodian, so the choice can be checked at startup rather
than at the first key operation\.

```csharp
public sealed class KeyPlacementChoice
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → KeyPlacementChoice

### Remarks
Riding the options\-validation pipeline is what buys the timing: `ValidateOnStart` registers an
`IStartupValidator`, and the host runs it BEFORE it starts any hosted service, including the one that
opens the HTTP port\. A hosted service of our own would only run once that port is already open\. The state
lives here rather than on `OidcOptions` because validating those would resolve the key provider, which
itself depends on those same options\.
### Fields

## KeyPlacementChoice\.PlacementNotChosenMessage Field {#Abblix.Jwt.ExternalKeys.KeyPlacementChoice.PlacementNotChosenMessage}

What a host is told when it registered a custodian and never said how its keys are used\.

```csharp
public const string PlacementNotChosenMessage = "A key custodian is registered, but where its private keys live was never chosen. Follow the custodian registration with UseKeysInCustodian() to keep the private half inside the custodian, or UseKeysInProcess() to mint keys locally and seal them to it.";
```

#### Field Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Held here rather than on whichever guard reports it, because more than one does: the startup validation
says it when the host has a lifetime to run validators, and the key provider says it when something asks
for keys without one\. Two guards saying different things about the same omission would read as two
different problems\.
### Properties

## KeyPlacementChoice\.ChosenPlacement Property {#Abblix.Jwt.ExternalKeys.KeyPlacementChoice.ChosenPlacement}

Where the placement call put the private halves, or null when no placement call ran\. Recording the choice
rather than inspecting the registered provider keeps the check independent of a host that layers its own
provider over the placement's\.

```csharp
public System.Nullable<Abblix.Jwt.ExternalKeys.KeyPlacement> ChosenPlacement { get; set; }
```

#### Property Value
[System\.Nullable&lt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')[KeyPlacement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement 'Abblix\.Jwt\.ExternalKeys\.KeyPlacement')[&gt;](https://learn.microsoft.com/en-us/dotnet/api/system.nullable-1 'System\.Nullable\`1')