Method: cryptoKeys.create

Full name: projects.locations.keyRings.cryptoKeys.create

Create a newCryptoKey within aKeyRing.

CryptoKey.purpose andCryptoKey.version_template.algorithm are required.

HTTP request


POST https://cloudkms.googleapis.com/v1/{parent=projects/*/locations/*/keyRings/*}/cryptoKeys

The URLs usegRPC Transcoding syntax.

Path parameters

Parameters
parent

string

Required. Thename of the KeyRing associated with theCryptoKeys.

Authorization requires the followingIAM permission on the specified resourceparent:

  • cloudkms.cryptoKeys.create

Query parameters

Parameters
cryptoKeyId

string

Required. It must be unique within a KeyRing and match the regular expression[a-zA-Z0-9_-]{1,63}

skipInitialVersionCreation

boolean

If set to true, the request will create aCryptoKey without anyCryptoKeyVersions. You must manually callcryptoKeyVersions.create orcryptoKeyVersions.import before you can use thisCryptoKey.

Request body

The request body contains an instance ofCryptoKey.

Response body

If successful, the response body contains a newly created instance ofCryptoKey.

Authorization scopes

Requires one of the following OAuth scopes:

  • https://www.googleapis.com/auth/cloudkms
  • https://www.googleapis.com/auth/cloud-platform

For more information, see theAuthentication Overview.

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-11 UTC.