{"id":20675589,"url":"https://github.com/bitwarden/key-connector","last_synced_at":"2025-08-20T10:31:10.011Z","repository":{"id":37957375,"uuid":"394749315","full_name":"bitwarden/key-connector","owner":"bitwarden","description":"An agent that stores and provides cryptographic keys to Bitwarden clients.","archived":false,"fork":false,"pushed_at":"2024-12-13T18:32:31.000Z","size":298,"stargazers_count":34,"open_issues_count":15,"forks_count":27,"subscribers_count":20,"default_branch":"main","last_synced_at":"2024-12-16T13:35:07.996Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bitwarden.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-08-10T18:39:27.000Z","updated_at":"2024-11-18T01:12:09.000Z","dependencies_parsed_at":"2024-02-28T01:29:54.255Z","dependency_job_id":"24518423-e2f9-40b6-b8b4-d48b8139fd17","html_url":"https://github.com/bitwarden/key-connector","commit_stats":null,"previous_names":[],"tags_count":10,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitwarden%2Fkey-connector","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitwarden%2Fkey-connector/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitwarden%2Fkey-connector/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitwarden%2Fkey-connector/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bitwarden","download_url":"https://codeload.github.com/bitwarden/key-connector/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":230415317,"owners_count":18222158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T21:09:54.064Z","updated_at":"2025-08-20T10:31:10.004Z","avatar_url":"https://github.com/bitwarden.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Bitwarden Key Connector\n\nThe Bitwarden Key Connector is a self-hosted web application that stores and provides cryptographic keys to Bitwarden\nclients.\n\nThe Key Connector project is written in C# using .NET Core with ASP.NET Core. The codebase can be developed, built, run,\nand deployed cross-platform on Windows, macOS, and Linux distributions.\n\n## Deploy\n\nThe Bitwarden Key Connector can be deployed using the pre-built docker container available on\n[ghcr.io](https://github.com/bitwarden/self-host/pkgs/container/key-connector).\n\n## Configuration\n\nA variety of configuration options are available for the Bitwarden Key Connector.\n\n### Bitwarden Server\n\nBy default, the Bitwarden server configuration points to the Bitwarden Cloud endpoints. If you are using a\nself-hosted Bitwarden installation, you will need to configure the web vault and identity server endpoints.\n\n```\nkeyConnectorSettings__webVaultUri=https://bitwarden.company.com\nkeyConnectorSettings__identityServerUri=https://bitwarden.company.com/identity/\n```\n\n### Database\n\nA database persists encrypted keys for your users. The following databases are supported to be configured. Migrating\nfrom one database provider to another is not supported at this time.\n\n**JSON File (default)**\n\n```\nkeyConnectorSettings__database__provider=json\nkeyConnectorSettings__database__jsonFilePath={FilePath}\n```\n\nBy default, the application stores the JSON file at the follow path: `/etc/bitwarden/data.json`.\n\n**Microsoft SQL Server**\n\n```\nkeyConnectorSettings__database__provider=sqlserver\nkeyConnectorSettings__database__sqlServerConnectionString={ConnectionString}\n```\n\n**PostgreSQL**\n\n```\nkeyConnectorSettings__database__provider=postgresql\nkeyConnectorSettings__database__postgreSqlConnectionString={ConnectionString}\n```\n\n**MySQL/MariaDB**\n\n```\nkeyConnectorSettings__database__provider=mysql\nkeyConnectorSettings__database__mySqlConnectionString={ConnectionString}\n```\n\n**SQLite**\n\n```\nkeyConnectorSettings__database__provider=sqlite\nkeyConnectorSettings__database__sqliteConnectionString={ConnectionString}\n```\n\n**MongoDB**\n\n```\nkeyConnectorSettings__database__provider=mongo\nkeyConnectorSettings__database__mongoConnectionString={ConnectionString}\nkeyConnectorSettings__database__mongoDatabaseName={DatabaseName}\n```\n\n### RSA Key\n\nThe Bitwarden Key Connector uses a RSA key pair to protect user keys at rest. The RSA key pair should be a minimum of\n2048 bits in length.\n\nYou must configure how the Bitwarden Key Connector accesses and utilizes your RSA key pair.\n\n**Certificate**\n\nAn X509 certificate that contains the RSA key pair.\n\n```\nkeyConnectorSettings__rsaKey__provider=certificate\n```\n\n*See additional certificate configuration options below.*\n\n**Azure Key Vault**\n\nYou will need to create an Azure Active Directory application that has access to read from the associated Key Vault.\n\n```\nkeyConnectorSettings__rsaKey__provider=azurekv\nkeyConnectorSettings__rsaKey__azureKeyvaultUri={URI}\nkeyConnectorSettings__rsaKey__azureKeyvaultKeyName={KeyName}\nkeyConnectorSettings__rsaKey__azureKeyvaultAdTenantId={ActiveDirectoryTenantId}\nkeyConnectorSettings__rsaKey__azureKeyvaultAdAppId={ActiveDirectoryAppId}\nkeyConnectorSettings__rsaKey__azureKeyvaultAdSecret={ActiveDirectorySecret}\n```\n\n**Google Cloud Key Management**\n\n```\nkeyConnectorSettings__rsaKey__provider=gcpkms\nkeyConnectorSettings__rsaKey__googleCloudProjectId={ProjectId}\nkeyConnectorSettings__rsaKey__googleCloudLocationId={LocationId}\nkeyConnectorSettings__rsaKey__googleCloudKeyringId={KeyringId}\nkeyConnectorSettings__rsaKey__googleCloudKeyId={KeyId}\nkeyConnectorSettings__rsaKey__googleCloudKeyVersionId={KeyVersionId}\n```\n\n**AWS Key Management Service**\n\n```\nkeyConnectorSettings__rsaKey__provider=awskms\nkeyConnectorSettings__rsaKey__awsAccessKeyId={AccessKeyId}\nkeyConnectorSettings__rsaKey__awsAccessKeySecret={AccessKeySecret}\nkeyConnectorSettings__rsaKey__awsRegion={RegionName}\nkeyConnectorSettings__rsaKey__awsKeyId={KeyId}\n```\n\n**PKCS11**\n\nUse a physical HSM device with the PKCS11 provider.\n\n```\nkeyConnectorSettings__rsaKey__provider=pkcs11\n# Available providers: yubihsm, opensc\nkeyConnectorSettings__rsaKey__pkcs11Provider={Provider}\nkeyConnectorSettings__rsaKey__pkcs11SlotTokenSerialNumber={TokenSerialNumber}\n# Available user types: user, so, context_specific\nkeyConnectorSettings__rsaKey__pkcs11LoginUserType={LoginUserType}\nkeyConnectorSettings__rsaKey__pkcs11LoginPin={LoginPIN}\n\n# Locate the private key on the device via label *or* ID.\nkeyConnectorSettings__rsaKey__pkcs11PrivateKeyLabel={PrivateKeyLabel}\nkeyConnectorSettings__rsaKey__pkcs11PrivateKeyId={PrivateKeyId}\n```\n\n*When using the PKCS11 provider to store your private key on an HSM device, the associated public key must be made\navailable and configured as a certificate (see below).*\n\n### Certificate\n\nThe RSA key pair can be provided via certificate configuration. The certificate should be made available as a PKCS12\n`.pfx` file. Example:\n\n```\nopenssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout bwkc.key\n  -out bwkc.crt -subj \"/CN=Bitwarden Key Connector\" -days 36500\n\nopenssl pkcs12 -export -out ./bwkc.pfx -inkey bwkc.key\n  -in bwkc.crt -passout pass:{Password}\n```\n\nIf using the PKCS11 RSA key provider, you will need to make a public key PKCS12 certificate available.\n\n**Filesystem (default)**\n\n```\nkeyConnectorSettings__certificate__provider=filesystem\nkeyConnectorSettings__certificate__filesystemPath={Path}\nkeyConnectorSettings__certificate__filesystemPassword={Password}\n```\n\nBy default, the application looks for a certificate at the follow path: `/etc/bitwarden/key.pfx`.\n\n**OS Certificate Store**\n\n```\nkeyConnectorSettings__certificate__provider=store\nkeyConnectorSettings__certificate__storeThumbprint={Thumbprint}\n```\n\n**Azure Blob Storage**\n\n```\nkeyConnectorSettings__certificate__provider=azurestorage\nkeyConnectorSettings__certificate__azureStorageConnectionString={ConnectionString}\nkeyConnectorSettings__certificate__azureStorageContainer={Container}\nkeyConnectorSettings__certificate__azureStorageFileName={FileName}\nkeyConnectorSettings__certificate__azureStorageFilePassword={FilePassword}\n```\n\n**Azure Key Vault**\n\nYou will need to create an Azure Active Directory application that has access to read from the associated Key Vault.\n\n```\nkeyConnectorSettings__certificate__provider=azurekv\nkeyConnectorSettings__certificate__azureKeyvaultUri={URI}\nkeyConnectorSettings__certificate__azureKeyvaultCertificateName={CertificateName}\nkeyConnectorSettings__certificate__azureKeyvaultAdTenantId={ActiveDirectoryTenantId}\nkeyConnectorSettings__certificate__azureKeyvaultAdAppId={ActiveDirectoryAppId}\nkeyConnectorSettings__certificate__azureKeyvaultAdSecret={ActiveDirectorySecret}\n```\n\n**HashiCorp Vault**\n\n```\nkeyConnectorSettings__certificate__provider=vault\nkeyConnectorSettings__certificate__vaultServerUri={ServerURI}\nkeyConnectorSettings__certificate__vaultToken={Token}\nkeyConnectorSettings__certificate__vaultSecretMountPoint={SecretMountPoint}\nkeyConnectorSettings__certificate__vaultSecretPath={SecretPath}\nkeyConnectorSettings__certificate__vaultSecretDataKey={SecretDataKey}\nkeyConnectorSettings__certificate__vaultSecretFilePassword={SecretFilePassword}\n```\n\n## Developer Documentation\n\nPlease refer to the [Key Connector section](https://contributing.bitwarden.com/getting-started/enterprise/key-connector) of the [Contributing Documentation](https://contributing.bitwarden.com/) for build instructions, recommended tooling, code style tips, and lots of other great information to get you started.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitwarden%2Fkey-connector","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbitwarden%2Fkey-connector","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitwarden%2Fkey-connector/lists"}