identityserver-key-management
Managing cryptographic signing keys in Duende IdentityServer, including automatic key management, KeyManagementOptions, data protection at rest, static key configuration, migration from static to automatic, and multi-instance deployment considerations, HSM/cloud KMS signing, key backup, and key-compromise response.
Install
With your agent
Install OMGSkills skill "duendesoftware/duende-skills:skills/identityserver-key-management" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/DuendeSoftware/duende-skills /tmp/duende-skills && ln -s /tmp/duende-skills/skills/identityserver-key-management ~/.claude/skills/identityserver-key-managementFrom README
Key Management and Signing When to Use This Skill Configuring automatic key management for signing token keys Setting up static/manual signing keys from certificates or key vaults Configuring key rotation intervals and key lifecycle Migrating from static keys to automatic key management Deploying IdentityServer in load-balanced or multi-instance environments Protecting keys at rest using data protection Configuring per-algorithm or per-resource signing Troubleshooting key-related errors (CryptographicException, unprotecting key failures) Integrating an HSM or cloud KMS (e.g. Azure Key Vault) for signing Backing up signing keys and responding to a suspected key compromise Docs: https://docs.duendesoftware.com/identityserver/fundamentals/key-management/ Core Concepts IdentityServer issues cryptographically signed tokens: identity tokens, JWT access tokens, and logout tokens. These signatures require key material that can be managed automatically or manually (statically).
More from this repo
aspnetcore-authentication
ASP.NET Core authentication middleware configuration including OpenID Connect, JWT Bearer, cookie authentication,...
aspnetcore-authorization
ASP.NET Core authorization patterns including policy-based authorization, IAuthorizationHandler implementations,...
claims-authorization
Claims transformation and profile service patterns for Duende IdentityServer — IProfileService, IClaimsTransformation,...