azure-keyvault-py

Topics in the source

• Azure Key Vault SDK for Python
• Installation
• Environment Variables
• Authentication & Lifecycle
• Secrets
• SecretClient Setup
• Secret Operations
• Keys

Secure storage and management for secrets, cryptographic keys, and certificates. 🔑 Two rules apply to every code sample below: 1. Prefer DefaultAzureCredential. It works locally (Azure CLI / VS Code / Developer CLI) and in Azure (managed identity, workload identity) with no code change. Avoid connection strings, account/API keys — they bypass Entra audit and rotation. - Local dev: DefaultAzureCredential works as-is. - Production: set AZURETOKENCREDENTIALS=prod (or AZURETOKENCREDENTIALS= ) to constrain the credential chain to production-safe credentials. 2. Wrap every client in a context manager so HTTP transports, sockets, and token caches are released deterministically: - Sync: with (...) as client: - Async: async with (...) as client: and async with DefaultAzureCredential() as credential: (from azure.identity.aio) Snippets may abbreviate this setup, but production code should always follow both rules. | Client | Package | Purpose | |--------|---------|---------| | SecretClient | azure-keyvault-secrets | Store/retrieve secrets | | KeyClient | azure-keyvault-keys | Manage cryptographic keys | | CryptographyClient | azure-keyvault-keys | Encrypt/decrypt/sign/verify | | CertificateC

This is an excerpt. Refer to the complete source and its current requirements.