KMS configuration

ZeroKMS is configured through the same credentials used by the Encryption SDK. The CS_WORKSPACE_CRN identifies your workspace in CRN format (e.g., crn:ap-southeast-2.aws:your-workspace-id).

For the full configuration reference — environment variables, programmatic config, and logging — see Encryption SDK configuration.

Getting credentials

Sign up at cipherstash.com/signup and follow the onboarding to generate your workspace credentials. You'll receive:

• Workspace CRN — identifies your workspace and region
• Client ID — identifies your application client
• Client key — your half of the dual-party key split
• Access key — API key for authenticating with CipherStash

Keysets

To use a specific keyset for multi-tenant isolation, pass the keyset option:

const client = await Encryption({
  schemas: [users],
  config: {
    keyset: { name: "tenant-a" },
  },
})

See Keysets for more details on multi-tenant key isolation.