---

name: azure-keyvault-keys-ts description: "使用 Azure Key Vault Keys SDK for JavaScript (@azure/keyvault-keys) 管理加密密钥。用于创建、加密/解密、签名或轮换密钥。" risk: unknown source: community date_added: "2026-02-27"

Azure Key Vault Keys SDK for TypeScript

使用 Azure Key Vault 管理加密密钥。

安装

# Keys SDK
npm install @azure/keyvault-keys @azure/identity

环境变量

KEY_VAULT_URL=https://<vault-name>.vault.azure.net
# Or
AZURE_KEYVAULT_NAME=<vault-name>

认证

import { DefaultAzureCredential } from "@azure/identity";
import { KeyClient, CryptographyClient } from "@azure/keyvault-keys";

const credential = new DefaultAzureCredential();
const vaultUrl = `https://${process.env.AZURE_KEYVAULT_NAME}.vault.azure.net`;

const keyClient = new KeyClient(vaultUrl, credential);
const secretClient = new SecretClient(vaultUrl, credential);

密钥操作

创建/设置密钥

const secret = await secretClient.setSecret("MySecret", "secret-value");

// With attributes
const secretWithAttrs = await secretClient.setSecret("MySecret", "value", {
  enabled: true,
  expiresOn: new Date("2025-12-31"),
  contentType: "application/json",
  tags: { environment: "production" }
});

获取密钥

// Get latest version
const secret = await secretClient.getSecret("MySecret");
console.log(secret.value);

// Get specific version
const specificSecret = await secretClient.getSecret("MySecret", {
  version: secret.properties.version
});

列出密钥

for await (const secretProperties of secretClient.listPropertiesOfSecrets()) {
  console.log(secretProperties.name);
}

// List versions
for await (const version of secretClient.listPropertiesOfSecretVersions("MySecret")) {
  console.log(version.version);
}

删除密钥

// Soft delete
const deletePoller = await secretClient.beginDeleteSecret("MySecret");
await deletePoller.pollUntilDone();

// Purge (permanent)
await secretClient.purgeDeletedSecret("MySecret");

// Recover
const recoverPoller = await secretClient.beginRecoverDeletedSecret("MySecret");
await recoverPoller.pollUntilDone();

密钥操作

创建密钥

// Generic key
const key = await keyClient.createKey("MyKey", "RSA");

// RSA key with size
const rsaKey = await keyClient.createRsaKey("MyRsaKey", { keySize: 2048 });

// Elliptic Curve key
const ecKey = await keyClient.createEcKey("MyEcKey", { curve: "P-256" });

// With attributes
const keyWithAttrs = await keyClient.createKey("MyKey", "RSA", {
  enabled: true,
  expiresOn: new Date("2025-12-31"),
  tags: { purpose: "encryption" },
  keyOps: ["encrypt", "decrypt", "sign", "verify"]
});

获取密钥

const key = await keyClient.getKey("MyKey");
console.log(key.name, key.keyType);

列出密钥

for await (const keyProperties of keyClient.listPropertiesOfKeys()) {
  console.log(keyProperties.name);
}

加密/解密

const cryptoClient = new CryptographyClient(key, credential);

// 加密
const encryptResult = await cryptoClient.encrypt("RSA-OAEP", Buffer.from("plaintext"));

// 解密
const decryptResult = await cryptoClient.decrypt("RSA-OAEP", encryptResult.result);
console.log(decryptResult.result.toString());

签名/验证

const digest = crypto.createHash("sha256").update("data").digest();

// 签名
const signResult = await cryptoClient.sign("RS256", digest);

// 验证
const verifyResult = await cryptoClient.verify("RS256", digest, signResult.result);
console.log(verifyResult.result); // true

密钥轮换

// 设置轮换策略
await keyClient.updateKeyRotationPolicy("MyKey", {
  lifetimeActions: [
    {
      action: "Rotate",
      timeAfterCreate: "P90D" // 90天后轮换
    }
  ],
  expiresIn: "P1Y" // 1年后过期
});

// 手动轮换
const newKey = await keyClient.rotateKey("MyKey");