#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')

## Abblix\.Jwt\.ExternalKeys Namespace

| Classes | |
| :--- | :--- |
| [CustodianHeldKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.CustodianHeldKeys 'Abblix\.Jwt\.ExternalKeys\.CustodianHeldKeys') | Selects which of the custodian's keys the host produces with, for a host that chose to keep the private halves where they never leave the custodian \(`UseKeysInCustodian`\)\. The keys belong to the operator: they are already provisioned in the custodian, so this only names them\. Each algorithm is advertised on the published key and forwarded to the custodian on every operation, so it must be one the custodian provisions for that key\. |
| [ExternalKeysServiceCollectionExtensions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ExternalKeysServiceCollectionExtensions 'Abblix\.Jwt\.ExternalKeys\.ExternalKeysServiceCollectionExtensions') | Wires an [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') \(an HSM, a cloud KMS, or a vault transit engine\) in two steps: WHICH custodian holds the keys, and HOW the library uses it\. The backend packages supply the first; the placement calls here supply the second, so a custodian and a placement compose freely instead of multiplying into one method per pair\. |
| [InMemoryKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.InMemoryKeyRing 'Abblix\.Jwt\.ExternalKeys\.InMemoryKeyRing') | A key ring whose keys are minted in this process and never leave it\. |
| [KeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.KeyCustodianBuilder') | The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. |
| [KeyPlacementChoice](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacementChoice 'Abblix\.Jwt\.ExternalKeys\.KeyPlacementChoice') | Records where the host chose to keep its private keys for its registered custodian, so the choice can be checked at startup rather than at the first key operation\. |
| [KeyRingOptions](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyRingOptions 'Abblix\.Jwt\.ExternalKeys\.KeyRingOptions') | Configuration of the key ring\. |
| [LocalKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.LocalKeys 'Abblix\.Jwt\.ExternalKeys\.LocalKeys') | What an in\-process key ring mints, and how often\. |
| [MintedKeys](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.MintedKeys 'Abblix\.Jwt\.ExternalKeys\.MintedKeys') | The policy for the placement where the server mints its own keys and the custodian only protects them \(`UseKeysInProcess`\): it generates them, encrypts them to the custodian's key\-encryption key, keeps the ciphertext in a shared ring, and rotates on schedule\. No key names here \- the server names what it creates\. |
| [ProduceFirstOrdering](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.ProduceFirstOrdering 'Abblix\.Jwt\.ExternalKeys\.ProduceFirstOrdering') | Orders a set of key versions so the one to produce with leads: whoever signs or encrypts takes the first key for an algorithm, while every version stays published so consumers can still verify or decrypt\. |
| [StoredKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.StoredKey 'Abblix\.Jwt\.ExternalKeys\.StoredKey') | One entry of the key ring: a private key the server minted, encrypted to the custodian's key\-encryption key, plus the two facts needed to place it without opening it\. |

| Interfaces | |
| :--- | :--- |
| [IKeyCustodian](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodian 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodian') | Host\-implemented custodian for the external private keys the library never holds in process: they live in an HSM, a cloud KMS, or a vault transit engine, and only the private operations cross the boundary\. A key published public\-only routes its private operation here by `kid`: SIGNING for a signing key, and for a decryption key an RSA/symmetric UNWRAP or an ECDH\-ES AGREEMENT\. The public operations \- signature verification, and wrapping a CEK with the recipient's public half \- stay in process and never reach the custodian\. Wire it with `AddCustodian` and a placement call; a host with no external keys leaves it unregistered\. |
| [IKeyCustodianBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyCustodianBuilder 'Abblix\.Jwt\.ExternalKeys\.IKeyCustodianBuilder') | The continuation of a custodian registration: the host has said WHICH custodian holds its keys and must now say HOW the library uses it\. These are two independent choices, and the second one is the security posture \- where the private half of a key lives \- so it is named at the call site and never defaulted\. The choices are `UseKeysInCustodian`, where the private half never enters this process and every signature and every CEK unwrap is a round\-trip to the custodian, and `UseKeysInProcess`, where the library mints its own keys and the custodian only seals them\. |
| [IKeyRing](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRing 'Abblix\.Jwt\.ExternalKeys\.IKeyRing') | Hands out the keys it holds to whoever asks for them\. |
| [IKeyRingStore](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IKeyRingStore 'Abblix\.Jwt\.ExternalKeys\.IKeyRingStore') | The shared place the server's minted keys live, so every pod serves one key set rather than its own\. Entries are encrypted to the custodian's key\-encryption key before they get here, so this store holds ciphertext and never a secret\. |
| [IMintedKeysBuilder](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.IMintedKeysBuilder 'Abblix\.Jwt\.ExternalKeys\.IMintedKeysBuilder') | The continuation of `UseKeysInProcess`: the placement that mints its own keys must say where the ring lives, and the packages hang their `PersistRingTo...` calls off this\. |

| Enums | |
| :--- | :--- |
| [KeyPlacement](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.ExternalKeys.KeyPlacement 'Abblix\.Jwt\.ExternalKeys\.KeyPlacement') | Where the private half of a key lives once a custodian is wired\. This is the security posture, so a host names it at the call site and the library never picks one\. |