> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nebius.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to create keys in Key Management Service

You can create [symmetric and asymmetric keys](/kms/types-operations#symmetric-and-asymmetric-keys) in Key Management Service (KMS):

* Create a symmetric key if you need to encrypt and decrypt data with the same key material or generate data keys for envelope encryption.
* Create an asymmetric key if you need a public-private key pair.

## Prerequisites

Make sure you are in a [group](/iam/authorization/groups/index) that has at least the `editor` role within your tenant or project; for example, the default `editors` group. You can check this in the [Administration → IAM](https://console.nebius.com/iam) section of the web console.

## How to create a symmetric key

<Tabs group="interfaces">
  <Tab title="Web console">
    1. In the [web console](https://console.nebius.com), go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/BhI64Dlym_yJl7Yy/_assets/sidebar/cryptography.svg?fit=max&auto=format&n=BhI64Dlym_yJl7Yy&q=85&s=e2af8c31917650f2951761ab265dd9b9" width="14" height="16" data-path="_assets/sidebar/cryptography.svg" /> **Cryptography** → **KMS**.

    2. Click <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/plus.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=7c9efc69d65fc58db0eb73702fd81aa1" width="16" height="16" data-path="_assets/plus.svg" /> **Create key**.

    3. Specify a unique key name.

    4. In the **Type** field, select **Symmetric key**.

    5. (Optional) In **Rotation period**, set how often KMS should automatically [rotate the key material](/kms/types-operations#key-rotation). When a key is rotated, KMS generates a new key version and immediately sets it as the default version. You can set the rotation period in days, months or years.

       The **Algorithm** value is set automatically to **AES-256-GCM**.

    6. (Optional) Add a description.

    7. Click **Create key**.

    The key appears in the list of symmetric keys.
  </Tab>

  <Tab title="CLI">
    Create a symmetric key:

    ```bash theme={null}
    nebius kms symmetric-key create \
       --name <key_name> \
       --description "<key_description>" \
       --algorithm aes_256 \
       --rotation-period <period>
    ```

    The command contains the following parameters:

    * `--name`: Name of the key.
    * `--description` (optional): Description of the key.
    * `--algorithm`: [Key encryption algorithm](/kms/types-operations#encryption-algorithms). You can only specify the algorithm when you create a key. You can't update it later. The only supported value is `aes_256`.
    * `--rotation-period` (optional): Period after which KMS automatically [rotates the key material](/kms/types-operations#key-rotation).

      When a key is rotated, KMS generates a new key version and immediately sets it as the default version.

      Specify the value in the `NhNmNs` format, for example, `24h` or `48h30m10s`. The minimum value is `86400s` (one day) and the maximum value is `315360000s` (3650 days). The default value is `7776000s` (90 days).
  </Tab>
</Tabs>

## How to create an asymmetric key

<Tabs group="interfaces">
  <Tab title="Web console">
    1. In the [web console](https://console.nebius.com), go to <Icon icon="https://mintcdn.com/nebius-ai-cloud/BhI64Dlym_yJl7Yy/_assets/sidebar/cryptography.svg?fit=max&auto=format&n=BhI64Dlym_yJl7Yy&q=85&s=e2af8c31917650f2951761ab265dd9b9" width="14" height="16" data-path="_assets/sidebar/cryptography.svg" /> **Cryptography** → **KMS**.
    2. Click <Icon icon="https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/plus.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=7c9efc69d65fc58db0eb73702fd81aa1" width="16" height="16" data-path="_assets/plus.svg" /> **Create key**.
    3. Specify a unique key name.
    4. In the **Type** field, select **Asymmetric key**.
    5. In the **Algorithm** field, select **RSA-4096** or **ECC (P-256)**.
    6. (Optional) Add a description.
    7. Click **Create key**.

    The key appears in the list of asymmetric keys.
  </Tab>

  <Tab title="CLI">
    Create an asymmetric key:

    ```bash theme={null}
    nebius kms asymmetric-key create \
       --name <key_name> \
       --description "<key_description>" \
       --algorithm <asymmetric_key_algorithm>
    ```

    The command contains the following parameters:

    * `--name`: Name of the key.
    * `--description` (optional): Description of the key.
    * `--algorithm`: Cryptographic algorithm to use with the key. You can only specify the algorithm when you create a key. You can't update it later. The supported values are:

      * `ecdsa_nist_p256_sha_256`
      * `ecdsa_nist_p384_sha_384`
      * `rsa_4096_enc_oaep_sha_256`

      For the description of the supported algorithms, see [Encryption algorithms](/kms/types-operations#encryption-algorithms).
  </Tab>
</Tabs>

## See also

* [Cryptographic operations with symmetric keys](/kms/cryptography/symmetric)
* [Cryptographic operations with asymmetric keys](/kms/cryptography/asymmetric)
* [How to rotate symmetric keys in Key Management Service](/kms/manage/rotate)