An Ethers.js compatible signer that connects to Azure Key Vault
npm install ethersjs-azure-keyvault-signer


npm install ethersjs-azure-keyvault-signer
Authentication to Azure Key Vault can be done either using client secret, client certificate or access token(with the Key Vault scope).
``ts`
interface AzureKeyVaultCredentials {
keyName: string;
vaultName: string;
clientId?: string;
tenantId?: string;
clientSecret?: string;
clientCertificatePath?: string;
accessToken?: AccessToken;
keyVersion?: string
}
- Client Secret
`ts`
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
- Client Certificate
`ts`
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientCertificatePath: './directory/cert.pem',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
> Note: The client certificate should be a .pem encoded file with unencrypted private key included.
- Access Token
`ts
import { AccessToken } from "@azure/core-auth";
const accessTokenObject : AccessToken = {
token: '
expiresOnTimestamp: '
};
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
accessToken: accessTokenObject,
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
`
You need to provide the Azure Key Vault credentials to instantiate an instance of AzureKeyVaultSigner shown below.
All examples below use client secret based authentication.
`ts
import {AzureKeyVaultCredentials, AzureKeyVaultSigner} from 'ethersjs-azure-keyvault-signer';
import {ethers} from 'ethers';
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
let azureKeyVaultSigner = new AzureKeyVaultSigner(keyVaultCredentials);
const provider = ethers.providers.getDefaultProvider('rinkeby');
azureKeyVaultSigner = azureKeyVaultSigner.connect(provider);
const tx = await azureKeyVaultSigner.sendTransaction({ to: '0x19De7137aEba698D5970d0B2d41eB03e0F97fA56', value: 2 });
console.log(tx);
`
`ts
import {AzureKeyVaultCredentials, AzureKeyVaultSigner} from 'ethersjs-azure-keyvault-signer';
import {ethers} from 'ethers';
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
let azureKeyVaultSigner = new AzureKeyVaultSigner(keyVaultCredentials);
const provider = ethers.providers.getDefaultProvider('rinkeby');
azureKeyVaultSigner = azureKeyVaultSigner.connect(provider);
console.log(azureKeyVaultSigner);
`
`ts
import {AzureKeyVaultCredentials, AzureKeyVaultSigner} from 'ethersjs-azure-keyvault-signer';
import {ethers} from 'ethers';
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
let azureKeyVaultSigner = new AzureKeyVaultSigner(keyVaultCredentials);
const ethereumAddress = await azureKeyVaultSigner.getAddress();
console.log(ethereumAddress);
`
`ts
import {AzureKeyVaultCredentials, AzureKeyVaultSigner} from 'ethersjs-azure-keyvault-signer';
import {ethers} from 'ethers';
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
let azureKeyVaultSigner = new AzureKeyVaultSigner(keyVaultCredentials);
const message = 'Hello World!';
const signedMessage = await azureKeyVaultSigner.signMessage(message);
console.log(signedMessage);
`
`ts
import {AzureKeyVaultCredentials, AzureKeyVaultSigner} from 'ethersjs-azure-keyvault-signer';
import {ethers} from 'ethers';
const keyVaultCredentials : AzureKeyVaultCredentials = {
keyName: 'my-key',
vaultUrl: 'https://my-vault.vault.azure.net',
clientId: 'ACIXXXXXXXXXXXX',
clientSecret: 'XXXXXXXXXXXXXXXXX',
tenantId: 'ATIXXXXXXXXXXXXXXXX',
keyVersion: '610f2XXXXXXXXXXX' //optional; if not included, latest version of the key is fetched
};
let azureKeyVaultSigner = new AzureKeyVaultSigner(keyVaultCredentials);
const transaction : ethers.providers.TransactionRequest = {
to: '0x19De7137aEba698D5970d0B2d41eB03e0F97fA56',
value: 2
};
const signedTransaction = await azureKeyVaultSigner.signTransaction(transaction);
console.log(signedTransaction);
``