Creates a new key source instance.
Note: The config may be empty/undefined when using ClassFactory. Configuration is typically loaded from the database and passed when retrieving keys.
Optionalconfig: EncryptionKeySourceConfigOptional configuration for the key source
Protected_Configuration passed during instantiation. Contains lookupValue and any source-specific additional config.
Cleans up Azure Key Vault clients.
Retrieves encryption key material from Azure Key Vault.
Secret URL or name (if AZURE_KEYVAULT_URL is set)
OptionalkeyVersion: stringOptional secret version (uses latest if not specified)
Buffer containing the key material
Initializes the Azure Key Vault client.
Lazy-loads the Azure SDK to avoid requiring it when not used. Uses DefaultAzureCredential for authentication.
Checks if a secret name/URL appears to be valid.
The secret URL or name
true if the lookup value appears valid
Validates that the Azure Key Vault client is properly configured.
true if the client is initialized
Validates that the Azure Key Vault secret is accessible and usable.
Attempts to retrieve the secret and validate its format and length. Key material is decoded internally for validation only — never returned to the caller.
OptionalkeyVersion: stringOptionalexpectedKeyLengthBytes: number
Azure Key Vault key source provider.
Retrieves encryption keys from Azure Key Vault secrets. Secrets should contain base64-encoded key material.
Security Notes
Example