KMS

Store agent signing keys in a hardware-backed KMS instead of the local encrypted store. Enterprise tier supports bring-your-own KMS: customers provide their own AWS KMS or GCP KMS account, Asqav holds only the key reference and calls the KMS to sign.

Tier gating

Bring-your-own KMS is Enterprise-only. The Free plan uses the local encrypted key store. Creating an agent with use_cloud_kms=true on Free returns 403 Forbidden.

Concept

By default, each agent holds an ML-DSA secret key encrypted at rest in the Asqav database. With Cloud KMS enabled, the secret key never leaves the KMS. Asqav only holds a key reference (provider, key id, version) and calls the KMS every time it signs. Supported providers are AWS KMS with ML_DSA_65 and GCP KMS with PQ_SIGN_ML_DSA_65. AWS KMS is FIPS 140-3 Level 3. GCP Cloud KMS provides FIPS 140-2 Level 3 key material (ML-DSA is in preview).

Create an agent backed by Cloud KMS

Opt in by sending use_cloud_kms=true on agent creation. The API provisions a KMS key in the region and ring configured on the server and stores only the key reference.

bash

curl -X POST https://api.asqav.com/api/v1/agents/create \
  -H "X-API-Key: sk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"name":"payments-bot","algorithm":"ml-dsa-65","use_cloud_kms":true}'

Key rotation

Create a new agent version pointing at a fresh KMS key, then disable the old one. Issued signatures remain verifiable because the public key used for each signature is stored with the record. The old key reference stays readable for audit replay.

Enterprise: BYO KMS

Enterprise customers can host the KMS key material in their own AWS or GCP account. Asqav calls your KMS over cross-account IAM. No key material is copied to Asqav. This is set up during onboarding, contact info@asqav.com.

Verification

A KMS-backed agent lists a key_id prefixed with kms_ and records the provider inside its KMS reference. You can confirm a signature used KMS by inspecting the agent:

bash

curl https://api.asqav.com/api/v1/agents/agt_abc123 \
  -H "X-API-Key: sk_live_..."

The response includes key_id and whether the agent uses cloud KMS. If the KMS is unreachable, agent creation and signing return 503 Service Unavailable and do not fall back to local keys.

Generate local keypairs from the terminal with asqav keys generate.