Solutions Integration

Key storage and HSMs

The key storage provider is chosen when you generate a signing key under Security → Signing keys. LumoAuth stores only the public key and the provider's key reference; signing happens inside the provider.

Start free Key storage and HSMs
app.lumoauth.dev
Choosing a key storage provider

What connects

Cloud KMS

AWAWS KMS AZAzure Key Vault GOGoogle Cloud KMS OROracle OCI Vault IBIBM Key Protect and HPCS

Hardware security modules

AWAWS CloudHSM AZAzure Managed HSM THThales CipherTrust FOFortanix DSM ENEntrust KeyControl ANAny PKCS#11 HSM (signing sidecar)

Vaults

HAHashiCorp Vault OPOpenBao AKAkeyless LOLocal (database, sealed with your encryption key)

How LumoAuth solves it

Generate a key in the provider

The form validates credentials and key policy; rotation and health checks work the same for every provider. Docs

Which plan you need

External key providers are the Bring-your-own signing keys add-on ($299/month) on Business.

See all plans and add-ons

Documentation

Key storage and HSMsdocs.lumoauth.dev/integrations/key-storage Signing keysdocs.lumoauth.dev/user-guide/applications/signing-keys

Ship passwordless sign-in this week. Put guardrails on your agents today.

The Developer plan is free for 10,000 monthly users and ten agents, with no card. Everything speaks open standards, so moving in or out is a config change.

Start free Talk to us Read the docs