---
title: "Key Management Service overview"
slug: "security-kms"
tags: ["API Gateway", "Key Management Service", "overview", "Sub Account"]
updated: 2026-09-17T10:25:45Z
published: 2026-09-17T10:25:45Z
canonical: "api.ncloud-docs.com/security-kms"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://api.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Key Management Service overview

Available in Classic and VPC

Key Management Service is a NAVER Cloud Platform service that provides encryption key management functions essential for encryption operations and implementation. Key Management Service provides APIs for various key management features, including encryption and decryption, in the form of RESTful.

Note

On June 19, 2025, the Region isolation key feature will be added to API 2.0. For more information, see [**Key Management Service concept > Key isolation**](https://guide.ncloud-docs.com/docs/en/kms-info#%ED%82%A4%EA%B2%A9%EB%A6%AC).

- All keys created and in operation before the feature is added will automatically be converted to global keys, and there will be no change to the APIs you are using.

|  | Key Management Service API 1.0 | Key Management Service API 2.0 |
| --- | --- | --- |
| Base URL (domain) | https://kms.apigw.ntruss.com | - Global: https://ocapi.ncloud.com - Isolation: Korea (KR): https://ocapi-kr.ncloud.com - Isolation: Japan (JP): https://ocapi-jp.ncloud.com |
| API type | Only 6 encryption and decryption APIs are provided. - Encrypt, Decrypt, Create Custom Key, Re-encrypt, Sign, Verify | - 6 encryption and decryption APIs are provided. - Encrypt, Decrypt, Create Custom Key, Re-encrypt, Sign, Verify - All console-based key management features are provided. |
| Authentication method | User authentication using NAVER Cloud Platform account information | - Account authentication API: user authentication using NAVER Cloud Platform account information - token authentication API: key authentication token |
| Request handling performance | Based on Encrypt API (AES), up to 200 TPS - All keys share the 200 TPS processing performance. | Based on Encrypt API (AES), up to 300 TPS per key - Each key is individually guaranteed up to 300 TPS processing performance. |
| Availability guarantee | Region-specific high availability (HA) - In the event of a failure in the NAVER Cloud Platform Region, APIs such as Encrypt, Decrypt, Sign, and Verify are affected. | Region-specific or Cross-Region high availability (HA) - Global key: Cross-region multi-synchronization ensures uninterrupted operation for APIs such as encryption, decryption, signing, and verification that are not affected by NAVER Cloud Platform Region failures - Region isolation key: Support intra-Region redundancy for external transfer restrictions. |
| Request access control | Use the IP ACL feature of the sub account unit provided by the Sub Account service. | - IP ACL feature of the sub account unit provided by the Sub Account service - IP ACL that can be set by token unit |

## Common Key Management Service API 1.0 settings

The following describes commonly used request and response formats in Key Management Service API 1.0.

### Request

The following describes the common request format.

#### API URL

The request API URL is as follows:

```
https://kms.apigw.ntruss.com
```

#### Request headers

The following describes the request headers.

- API Gateway request signature v1 method request

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. |
| `x-ncp-apigw-api-key` | Required | Key issued by the API Gateway service of NAVER Cloud Platform |
| `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). |
| `x-ncp-apigw-signature-v1` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256) - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi). - Create signature: See [Create signature](/docs/en/common-ncpapi). |
- API Gateway request signature v2 method request

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. |
| `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). |
| `x-ncp-apigw-signature-v2` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256) - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi). - Create signature: See [Create signature](/docs/en/common-ncpapi). |

### Response

The following describes the common response format.

#### Response status codes

The following describes the response status codes.

| HTTP status code | Code | Message | Description |
| --- | --- | --- | --- |
| 200 | - | `success` | Succeeded |

Note

For information about the HTTP status codes common to all NAVER Cloud Platform, see [Ncloud API response status codes](/docs/en/common-ncpapi#3%EC%9D%91%EB%8B%B5%EC%83%81%ED%83%9C%EC%BD%94%EB%93%9C).

#### Error syntax

The following describes the error syntax that results from processing the request.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `error` | Object | - | Error information |
| `error.errorCode` | String | - | Error code |
| `error.message` | String | - | Error message |
| `error.details` | String | - | Error details |

```
{
"error": {
"errorCode": "300",
"message": "Not Found Exception",
"details": "URL not found."
}
}
```

The following describes the error syntax that has failed even though the status code is `200 OK`.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `code` | String | - | Error code |
| `msg` | String | - | Error message |
| `data` | Object | - | Response result - Displayed as `null` value |

- Example: Invalid request data input

```
{
"code": "NOT_VALID_INPUT",
"msg": "Fail: not valid input",
"data": null
}
```

## Common Key Management Service API 2.0 settings

The following describes commonly used request and response formats in Key Management Service API 2.0.

### Request

The following describes the common request format.

#### API URL

The request API URL is as follows:

```
https://ocapi.ncloud.com
```

#### Request headers

The following describes the request headers.

- Account authentication (Account Auth) method request

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-apigw-timestamp` | Required | This is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC. - Request is considered invalid if the timestamp differs from the current time by more than 5 minutes. - Unix timestamp format. |
| `x-ncp-iam-access-key` | Required | Access key issued on NAVER Cloud Platform - Issue and check access key: See [Create authentication key](/docs/en/common-ncpapi). - Issue and check access key for sub account: See [Create sub account](https://guide.ncloud-docs.com/docs/en/subaccount-use#%EC%84%9C%EB%B8%8C-%EA%B3%84%EC%A0%95-%EC%83%9D%EC%84%B1). |
| `x-ncp-apigw-signature-v2` | Required | Base64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256) - Issue and check secret key: See [Create authentication key](/docs/en/common-ncpapi). - Create signature: See [Create signature](/docs/en/common-ncpapi). |
- Token authentication (Token Auth) method request

| Field | Required | Description |
| --- | --- | --- |
| `x-ncp-ocapi-token` | Required | Access token or refresh token for keys generated by Key Management Service - JWT (JSON Web Token) type token - Create token: See [Create token set](/docs/en/security-kms2-token-set). - Used APIs - Access token: [Encrypt](/docs/en/security-kms2-token-encrypt), [Decrypt](/docs/en/security-kms2-token-decrypt), [Create custom key](/docs/en/security-kms2-token-custom-key), [Re-encrypt](/docs/en/security-kms2-token-reencrypt), [Sign](/docs/en/security-kms2-token-sign), [Verify](/docs/en/security-kms2-token-verify), [Get public key](/docs/en/security-kms2-token-public-key) - Refresh token: [Create access token](/docs/en/security-kms2-token-access-token), [Renew token set](/docs/en/security-kms2-token-renew) |

### Response

The following describes the common response format.

#### Response status codes

The following describes the response status codes.

| HTTP status code | Code | Message | Description |
| --- | --- | --- | --- |
| 200 | - | - | Success |
| 400 | 100 | `Bad Request` | Request error |
| 401 | - | `Authentication Failed` | Authentication error |
| 401 | - | `Permission Denied` | Permission error |
| 403 | - | `Forbidden` | Key resource not accessible |
| 404 | 300 | `Not Found` | Key resource not found |
| 429 | - | `Rate Limited` | Request quota exceeded |
| 500 | - | `Unexpected Error` | - `FAIL_SERVER_INTERNAL`: KMS system error - `FAIL_IAM_REQUEST`: Account or permission system error - `FAIL_CLA_REQUEST`: CLA system error - `FAIL_BLOC_REQUEST`: Member or contract inquiry system error |

#### Error syntax

The following describes the error syntax that results from processing the request.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `error` | Object | - | Error information |
| `error.errorCode` | String | - | Error code |
| `error.message` | String | - | Error message |
| `error.details` | String | - | Error details |

```
{
"error": {
"errorCode": "300",
"message": "Not Found",
"details": "null"
}
}
```

## Key Management Service API

The following describes the APIs provided by the Key Management Service API service.

### Key Management Service API 1.0

The following describes the APIs related to Key Management Service API 1.0.

| API | Description |
| --- | --- |
| [Encrypt](/docs/en/security-kms-encrypt) | Encrypt data with the current version of the key. |
| [Decrypt](/docs/en/security-kms-decrypt) | Decrypt ciphertext with a key. |
| [Create Custom Key](/docs/en/security-kms-createusercustomkey) | Create a random raw key to be used as a encryption key. |
| [Re-encrypt](/docs/en/security-kms-reencrypt) | Re-encrypt the ciphertext with the most recent version of the specified master key. |
| [Sign](/docs/en/security-kms-sign) | Create signature value of data. |
| [Verify](/docs/en/security-kms-verify) | Compare data and signature value and return verification result. |

### Key Management Service API 2.0

The following describes the APIs related to Key Management Service API 2.0.

#### Account Auth API

The following describes the APIs related to the Account Auth API.

| API | Description |
| --- | --- |
| [Create Key](/docs/en/security-kms2-create-key) | Create key. |
| [Get Key Info](/docs/en/security-kms2-key-info) | Get key details. |
| [Get Key List](/docs/en/security-kms2-key-list) | Get key list. |
| [Get Public Key](/docs/en/security-kms2-public-key) | Get public key. |
| [Delete Key](/docs/en/security-kms2-delete-key) | Delete key. |
| [Enable Key](/docs/en/security-kms2-enable-key) | Activate key. |
| [Disable Key](/docs/en/security-kms2-disable-key) | Deactivate key. |
| [Enable Key Version](/docs/en/security-kms2-enable-key-version) | Enable key version. |
| [Disable Key Version](/docs/en/security-kms2-disable-key-version) | Disable key version. |
| [Rotate Key](/docs/en/security-kms2-rotate-key) | Rotate a key to create a new version. |
| [Request Key Deletion](/docs/en/security-kms2-request-key-deletion) | Request key deletion. |
| [Cancel Key Deletion](/docs/en/security-kms2-cancel-key-deletion) | Cancel key deletion request. |
| [Enable IP ACL](/docs/en/security-kms2-enable-ip-acl) | Enable the IP ACL feature to control the IP addresses that are allowed to request tokens. |
| [Disable IP ACL](/docs/en/security-kms2-disable-ip-acl) | Disable the IP ACL feature to control the IP addresses that are allowed to request tokens. |
| [Get ACL Rule List](/docs/en/security-kms2-acl-list) | Get IP ACL configuration information for a key. |
| [Add ACL Rule](/docs/en/security-kms2-add-acl) | Add an IP address to the ACL to allow token requests. |
| [Delete ACL Rule](/docs/en/security-kms2-delete-acl) | Delete an IP address allowed to request tokens from the ACL. |
| [Create Token Generator](/docs/en/security-kms2-create-token-gen) | Activate token generator. |
| [Get Token Generator](/docs/en/security-kms2-get-token-gen) | Get token generator. |
| [Update Token Generator](/docs/en/security-kms2-update-token-gen) | Replace token generator. |
| [Delete Token Generator](/docs/en/security-kms2-token-encrypt) | Delete token generator (disable). |
| [Create Token Set](/docs/en/security-kms2-token-set) | Create a token set (refresh token and access token). |
| [Get Key Activity Logs](/docs/en/security-kms2-key-activity-logs) | Get key usage history list. |
| [Get Latest Use Info](/docs/en/security-kms2-latest-use-info) | Get the latest key usage history. |
| [Get Key Version List](/docs/en/security-kms2-key-version-list) | Get key version list. |
| [Update Memo](/docs/en/security-kms2-update-memo) | Edit notes for a key. |
| [Update Rotation Period](/docs/en/security-kms2-rotation-period) | Edit the automatic rotation cycle of a key. |
| [Enable Auto Rotation](/docs/en/security-kms2-enable-auto-rotation) | Enable automatic rotation of a key. |
| [Disable Auto Rotation](/docs/en/security-kms2-disable-auto-rotation) | Disable automatic rotation of a key. |
| [Encrypt](/docs/en/security-kms2-encrypt) | Encrypt data with the current version of the key. |
| [Decrypt](/docs/en/security-kms2-decrypt) | Decrypt ciphertext with a key. |
| [Create Custom Key](/docs/en/security-kms2-custom-key) | Create a random raw key to be used as a encryption key. |
| [Re-encrypt](/docs/en/security-kms2-reencrypt) | Re-encrypt the ciphertext with the most recent version of the specified master key. |
| [Sign](/docs/en/security-kms2-sign) | Create signature value of data. |
| [Verify](/docs/en/security-kms2-verify) | Compare data and signature value and return verification result. |

#### Token Auth API

The following describes the APIs related to the Token Auth API.

| API | Description |
| --- | --- |
| [Encrypt](/docs/en/security-kms2-token-encrypt) | Encrypt data with the current version of the key. |
| [Decrypt](/docs/en/security-kms2-token-decrypt) | Decrypt ciphertext with a key. |
| [Create Custom Key](/docs/en/security-kms2-token-custom-key) | Create a random raw key to be used as a encryption key. |
| [Re-encrypt](/docs/en/security-kms2-token-reencrypt) | Re-encrypt the ciphertext with the most recent version of the specified master key. |
| [Sign](/docs/en/security-kms2-token-sign) | Create signature value of data. |
| [Verify](/docs/en/security-kms2-token-verify) | Compare data and signature value and return verification result. |
| [Get Public Key](/docs/en/security-kms2-token-public-key) | Get public key. |
| [Create Access Token](/docs/en/security-kms2-token-access-token) | Create access token |
| [Renew Token Set](/docs/en/security-kms2-token-renew) | Recreate the token set (access token and refresh token) |

## Key Management Service related resources

NAVER Cloud Platform provides a variety of related resources to help users better understand Key Management Service APIs.

- Key Management Service API guides
- [Create signature](/docs/en/common-ncpapi): how to create a signature to add to the request header
- [API Gateway User Guide](https://guide.ncloud-docs.com/docs/en/apigw-apigw-1): how to issue the API key to be added to the request header
- [Sub Account User Guides](https://guide.ncloud-docs.com/docs/en/subaccount-overview): how to issue the access key to be added to the request header
- [Common Ncloud response status codes](/docs/en/common-ncpapi#3-%EC%9D%91%EB%8B%B5-%EC%83%81%ED%83%9C-%EC%BD%94%EB%93%9C): information on common response status codes of NAVER Cloud Platform used by Key Management Service
- How to use the Key Management Service service
- [Key Management Service User Guide](https://guide.ncloud-docs.com/docs/en/kms-overview): how to use Key Management Service in the NAVER Cloud Platform console
- [Ncloud use environment guide](https://guide.ncloud-docs.com/docs/en/environment-environment-1-1): guide for VPC and Classic environments and support availability
- [Introduction to pricing, characteristics, and detailed features](https://www.ncloud.com/product/security/kms): the summary of pricing system, characteristics, and detailed features of Key Management Service
- [Latest service news](https://www.ncloud.com/intro/news): the latest news on Key Management Service
- [FAQ](https://www.ncloud.com/support/faq/all): frequently asked questions from Key Management Service users
- [Support](https://www.ncloud.com/support/question/general): Send direct inquiries for unresolved questions that aren't answered by the API guide.