1# Key Vault Keys — .NET SDK Quick Reference
2 
3> Condensed from **azure-security-keyvault-keys-dotnet**. Full patterns
4> (crypto operations, key rotation, backup/restore, HSM, KeyResolver)
5> in the **azure-security-keyvault-keys-dotnet** plugin skill if installed.
6 
7## Install
8dotnet add package Azure.Security.KeyVault.Keys
9dotnet add package Azure.Identity
10 
11## Quick Start
12```csharp
13using Azure.Security.KeyVault.Keys;
14using Azure.Identity;
15var client = new KeyClient(new Uri("https://<vault>.vault.azure.net"), new DefaultAzureCredential());
16```
17 
18## Best Practices
19- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCredential — see [auth-best-practices.md](../auth-best-practices.md)
20- Enable soft-delete — protect against accidental deletion
21- Use HSM-backed keys — set `HardwareProtected = true` for sensitive keys
22- Implement key rotation — use automatic rotation policies
23- Limit key operations — only enable required KeyOperations
24- Set expiration dates — always set ExpiresOn for keys
25- Use specific versions — pin to versions in production
26- Cache CryptographyClient — reuse for multiple operations
27