REST Resource: projects.locations.instances.keyRings.keys

Resource: Key

A Key is a cryptographic key pair generated and used through threshold MPC. The private key never exists in one place: it is split into key shares held by Users, as defined by the KeyPolicy of the parent KeyRing.

Keys cannot be deleted or moved between KeyRings. They can only be disabled.

JSON representation 
{
  "name": string,
  "algorithm": enum (KeyAlgorithm),
  "keyShares": {
    object (KeySpec)
  },
  "state": enum (State),
  "publicKeyInfo": {
    object (PublicKeyInfo)
  },
  "createTime": string,
  "updateTime": string,
  "uid": string
}
Fields
name

string

Identifier. The resource name of the Key. Format: projects/{project}/locations/{location}/instances/{instance}/keyRings/{keyRing}/keys/{key}
algorithm

enum (KeyAlgorithm)

Required. Immutable. The signing algorithm of the Key.
keyShares

object (KeySpec)

Output only. The Users that hold the Key's key shares, and the thresholds needed to sign. The server fills this from the parent KeyRing's KeyPolicy when the Key is created.
state

enum (State)

Output only. The lifecycle state of the Key.
publicKeyInfo

object (PublicKeyInfo)

Output only. The public key and derived addresses. Set once the Key is ACTIVE.
createTime

string (Timestamp format)

Output only. The time at which the Key was created.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
updateTime

string (Timestamp format)

Output only. The time at which the Key was last updated.

Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: "2014-10-02T15:01:23Z", "2014-10-02T15:01:23.045123456Z" or "2014-10-02T15:01:23+05:30".
uid

string

Output only. The unique server-generated identifier of the Key.

KeyAlgorithm

The signing algorithm of a Key.

Enums
KEY_ALGORITHM_UNSPECIFIED Not specified.
EC_SIGN_SECP256K1 ECDSA on curve secp256k1 (Bitcoin, Ethereum, and EVM-compatible chains).
EC_SIGN_ED25519 EdDSA on curve Ed25519 (Solana, NEAR, Cardano, Sui).

KeySpec

A node in the tree of key-share holders.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "userKeyShares": {
    object (UserKeyShares)
  },
  "keyShareNode": {
    object (KeyShareNode)
  }
  // End of mutually exclusive fields.
}
Fields
The kind of node. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
userKeyShares

object (UserKeyShares)

Output only. The key shares held by one User.
keyShareNode

object (KeyShareNode)

Output only. A nested threshold rule over child nodes.
End of mutually exclusive fields.

UserKeyShares

The key shares one User holds for a Key, resolved from a KeyPolicy UserNode or TeamNode when the Key was created.

JSON representation 
{
  "user": string,
  "threshold": integer,
  "shareStorage": [
    {
      object (StorageInfo)
    }
  ]
}
Fields
user

string

Output only. The resource name of the User that holds the key shares. Format: projects/{project}/locations/{location}/instances/{instance}/users/{user}
threshold

integer

Output only. The number of this User's key shares needed to sign. Currently always 1.
shareStorage[]

object (StorageInfo)

Output only. Where each of the User's key shares is stored, one entry per key share. Currently always exactly one entry.

KeyShareNode

A k-of-n threshold rule over child nodes, resolved from the KeyPolicy when the Key was created.

JSON representation 
{
  "keyShareNodeId": string,
  "threshold": integer,
  "subKeyShares": [
    {
      object (KeySpec)
    }
  ],
  "storageInfo": {
    object (StorageInfo)
  }
}
Fields
keyShareNodeId

string

Output only. The policyNodeId of the KeyPolicy PolicyNode this node was resolved from. Empty if the node was resolved from a TeamNode or UserNode.
threshold

integer

Output only. The number of children in subKeyShares needed to sign.
subKeyShares[]

object (KeySpec)

Output only. The child nodes.
storageInfo

object (StorageInfo)

Output only. Where the key shares under this node are stored.

State

The lifecycle state of a Key.

Enums
STATE_UNSPECIFIED Not specified.
CREATING Distributed key generation is in progress. The Key cannot sign yet.
ACTIVE Distributed key generation succeeded. The Key can sign.
DISABLED The Key is disabled and cannot sign. Its key shares are kept.
FAILED Distributed key generation failed. No usable key material exists. This state is terminal.

PublicKeyInfo

The public half of the Key and the addresses derived from it.

JSON representation 
{
  "publicKey": string,
  "blockchainAddresses": {
    object (BlockchainAddresses)
  }
}
Fields
publicKey

string (bytes format)

Output only. The public key. For EC_SIGN_SECP256K1 this is the 65-byte uncompressed point starting with 0x04. For EC_SIGN_ED25519 this is the 32-byte encoded point.

A base64-encoded string.
blockchainAddresses

object (BlockchainAddresses)

Output only. Blockchain addresses derived from publicKey.

BlockchainAddresses

Blockchain addresses derived from a public key, grouped by curve.

JSON representation 
{

  // The following is a list of mutually exclusive fields. At most one of the
  // fields will be set in a response:
  "secp256k1Addresses": {
    object (Secp256k1Addresses)
  },
  "ed25519Addresses": {
    object (Ed25519Addresses)
  }
  // End of mutually exclusive fields.
}
Fields
The addresses for the key's curve. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response:
secp256k1Addresses

object (Secp256k1Addresses)

Output only. Addresses derived from a SECP256K1 public key.
ed25519Addresses

object (Ed25519Addresses)

Output only. Addresses derived from an Ed25519 public key.
End of mutually exclusive fields.

Secp256k1Addresses

Addresses derived from a SECP256K1 public key.

JSON representation 
{
  "ethereumAddress": string,
  "bitcoinMainnetAddresses": {
    object (BitcoinAddresses)
  }
}
Fields
ethereumAddress

string

Output only. The Ethereum address derived from the public key. Formatted as a hex string with a 0x prefix.
bitcoinMainnetAddresses

object (BitcoinAddresses)

Output only. The Bitcoin mainnet addresses derived from the public key.

BitcoinAddresses

Single-key Bitcoin addresses derived from the compressed SECP256K1 public key. Taproot (P2TR) addresses are not included because they require Schnorr signatures.

JSON representation 
{
  "p2wpkhAddress": string,
  "p2shP2wpkhAddress": string,
  "p2pkhAddress": string
}
Fields
p2wpkhAddress

string

Output only. The native SegWit (P2WPKH) address. Formatted as a bech32 string, e.g. bc1q....
p2shP2wpkhAddress

string

Output only. The nested SegWit (P2SH-P2WPKH) address. Formatted as a base58check string, e.g. 3....
p2pkhAddress

string

Output only. The legacy (P2PKH) address. Formatted as a base58check string, e.g. 1....

Ed25519Addresses

Addresses derived from an Ed25519 public key.

JSON representation 
{
  "solanaAddress": string
}
Fields
solanaAddress

string

Output only. The Solana address derived from the public key. Formatted as a base58 string.

Methods

create

 Creates a new Key in a KeyRing by running distributed key generation (DKG).

disable

 Disables a Key so it can no longer sign.

get

 Gets details of a single Key.

list

 Lists Keys in a KeyRing.