1# Key Vault — Python SDK Quick Reference
2 
3> Condensed from **azure-keyvault-py**. Full patterns (async clients,
4> cryptographic operations, certificate management, error handling)
5> in the **azure-keyvault-py** plugin skill if installed.
6 
7## Install
8pip install azure-keyvault-secrets azure-keyvault-keys azure-keyvault-certificates azure-identity
9 
10## Quick Start
11```python
12from azure.identity import DefaultAzureCredential
13from azure.keyvault.secrets import SecretClient
14client = SecretClient(vault_url="https://<vault>.vault.azure.net/", credential=DefaultAzureCredential())
15```
16 
17## Best Practices
18- Use DefaultAzureCredential for **local development only**. In production, use ManagedIdentityCredential — see [auth-best-practices.md](../auth-best-practices.md)
19- Use managed identity in Azure-hosted applications
20- Enable soft-delete for recovery (enabled by default)
21- Use RBAC over access policies for fine-grained control
22- Rotate secrets regularly using versioning
23- Use Key Vault references in App Service/Functions config
24- Cache secrets appropriately to reduce API calls
25- Use async clients for high-throughput scenarios
26