> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Management Service (KMS)

> Keep cryptographic keys in Infisical instead of in your applications.

Infisical Key Management Service (KMS) stores cryptographic keys and runs operations with them, such as encryption and signing, so your applications never have access to the keys themselves.

You can use your keys from the Infisical UI, the [API](https://infisical.com/docs/api-reference/endpoints/kms/keys/list.md), KMIP clients, Kubernetes, and Sigstore Cosign.

> [!TIP]
>
> To learn how Infisical KMS protects your keys, check out the [Concepts](https://infisical.com/docs/documentation/platform/kms/concepts.md) page.

## Keys

Create keys in a KMS project, then use them to process your data:

> [card] [Create and manage keys](https://infisical.com/docs/documentation/platform/kms/keys.md)
>
> Create the keys that your applications use.

> [card] [Encrypt and decrypt](https://infisical.com/docs/documentation/platform/kms/encrypt-decrypt.md)
>
> Encrypt and decrypt data with a key in Infisical KMS.

> [card] [Sign and verify](https://infisical.com/docs/documentation/platform/kms/sign-verify.md)
>
> Sign data and verify signatures with a key in Infisical KMS.

> [card] [Generate and verify MACs](https://infisical.com/docs/documentation/platform/kms/mac.md)
>
> Use message authentication codes to check that data hasn't changed.

> [card] [Rotate keys](https://infisical.com/docs/documentation/platform/kms/key-rotation.md)
>
> Replace a key's key material without changing your applications.

> [card] [Export and import keys](https://infisical.com/docs/documentation/platform/kms/export-import.md)
>
> Move key material in and out of Infisical KMS.

## KMIP

Let storage arrays, databases, and other KMIP clients manage their keys in Infisical:

> [card] [Overview](https://infisical.com/docs/documentation/platform/kms/kmip.md)
>
> Let devices and software that support KMIP manage their keys.

> [card] [Deploy a KMIP server](https://infisical.com/docs/documentation/platform/kms/kmip-server.md)
>
> Run the KMIP server that your KMIP clients connect to.

> [card] [Connect KMIP clients](https://infisical.com/docs/documentation/platform/kms/kmip-clients.md)
>
> Connect a KMIP client to the keys in a KMS project.

> [card] [Dell PowerEdge SEKM](https://infisical.com/docs/documentation/platform/kms/kmip-dell-poweredge.md)
>
> Encrypt the drives in Dell PowerEdge servers with keys from Infisical KMS.

## Integrations

Use your keys from tools that support Infisical KMS:

> [card] [Kubernetes encryption](https://infisical.com/docs/documentation/platform/kms/kubernetes-encryption.md)
>
> Encrypt Kubernetes secrets at rest with a key in Infisical KMS.

> [card] [Sigstore Cosign](https://infisical.com/docs/documentation/platform/kms/sigstore-cosign.md)
>
> Sign container images with a key in Infisical KMS.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.