# kms v0.1.0 - Table of Contents

> Key management service with embedded OTP runtime, optional HTTP API, SQLite/PostgreSQL storage, and external RMK providers

## Pages

- [KMS](readme.md)
- [Changelog](changelog.md)
- [Authentication factors](factors.md)
- [One-time-code factor](one_time_code.md)
- [TOTP factors](totp.md)
- [WebAuthn/passkeys](webauthn.md)
- [Sessions](sessions.md)

- Guides
  - [Authorization and bindings](authz-bindings.md)
  - [Configuration](configuration.md)
  - [Elixir API](elixir-api.md)
  - [HTTP API](http-api.md)
  - [Installation](installation.md)
  - [Local vs remote KMS](local-vs-remote.md)
  - [KMS overview](overview.md)
  - [Quickstart: KMS in a Phoenix app](quickstart.md)

- Use cases
  - [Use cases](use_cases.md)
  - [Application-wide encryption without KMS storage](application_wide.md)
  - [Crypto-only library mode](crypto_only.md)
  - [Embedded KMS in an application](embedded.md)
  - [Factor-bound aliases](factor_bound_aliases.md)
  - [Multi-user encryption](multi_user_encryption.md)
  - [Shared passphrase documents](passphrase.md)
  - [Remote KMS service](remote.md)
  - [Standalone KMS with SQLite](standalone.md)

- Security
  - [Security policy](security-1.md)
  - [Additional authenticated data (AAD)](aad.md)
  - [Security](security-2.md)
  - [Crash dumps](crash-dumps.md)
  - [Security stance](stance.md)

- Operations
  - [KMS database configuration](database.md)
  - [Fallback recovery](fallback-recovery.md)
  - [Migrations and upgrades](migrations-upgrades.md)
  - [KMS observability](observability.md)
  - [Operations](operations.md)
  - [Root master keys (RMK)](rmk.md)
  - [AWS KMS RMK provider](aws.md)
  - [Google Cloud KMS RMK provider](gcp.md)
  - [Local RMK provider](local.md)
  - [StackIT RMK provider](stackit.md)

## Modules

- [KMS.API.Server](KMS.API.Server.md): Optional Bandit HTTP server for the KMS API.

- [KMS.AsymmetricCrypto](KMS.AsymmetricCrypto.md): Small ECDH envelope helper.
- [KMS.Authorization](KMS.Authorization.md): Authorization checks against principal bindings.

- [KMS.Bindings](KMS.Bindings.md): Principal permission bindings.

- [KMS.Bindings.Permission](KMS.Bindings.Permission.md): Permission parser and wildcard expansion for KMS authorization.

- [KMS.Bindings.Resource](KMS.Bindings.Resource.md): Converts domain structs into authorization resource scopes.

- [KMS.Bindings.Scope](KMS.Bindings.Scope.md): Scope parser and wildcard expansion for KMS authorization.

- [KMS.Cache](KMS.Cache.md): Process-local ETS cache for short-lived KMS data.

- [KMS.Client.Remote.Binding](KMS.Client.Remote.Binding.md): Remote-safe authorization binding metadata.

- [KMS.Client.Remote.FallbackPublicKey](KMS.Client.Remote.FallbackPublicKey.md): Remote-safe fallback public key metadata.

- [KMS.Client.Remote.Kek](KMS.Client.Remote.Kek.md): Remote-safe KEK metadata.

- [KMS.Client.Remote.KekFallback](KMS.Client.Remote.KekFallback.md): Remote-safe KEK fallback metadata.

- [KMS.Client.Remote.Principal](KMS.Client.Remote.Principal.md): Remote-safe principal metadata.

- [KMS.Client.Remote.PrincipalFactor](KMS.Client.Remote.PrincipalFactor.md): Remote-safe principal factor metadata.

- [KMS.Client.Remote.PrincipalFallback](KMS.Client.Remote.PrincipalFallback.md): Remote-safe principal fallback metadata.

- [KMS.Client.Remote.Session](KMS.Client.Remote.Session.md): Remote session handle and metadata.

- [KMS.CryptoStream](KMS.CryptoStream.md): Cryptography functions for encrypting and decrypting data using AES-CBC.
- [KMS.Fallbacks](KMS.Fallbacks.md): Recovery wrapping for KEKs and principal private keys.

- [KMS.Fallbacks.KekFallback](KMS.Fallbacks.KekFallback.md)
- [KMS.Fallbacks.PrincipalFallback](KMS.Fallbacks.PrincipalFallback.md)
- [KMS.Fallbacks.PublicKey](KMS.Fallbacks.PublicKey.md)
- [KMS.Health](KMS.Health.md): Runtime health checks for KMS.

- [KMS.Kek](KMS.Kek.md)
- [KMS.Keks](KMS.Keks.md)
- [KMS.Keks.Cleanup](KMS.Keks.Cleanup.md): Cleanup retired KEKs after callers re-encrypt data with current KEK versions.
- [KMS.Principals](KMS.Principals.md): Principal CRUD and password helpers.

- [KMS.Principals.FactorProvider](KMS.Principals.FactorProvider.md): Issues authentication factor challenges.
- [KMS.Principals.Factors.WebAuthn](KMS.Principals.Factors.WebAuthn.md): WebAuthn/passkey factor provider.
- [KMS.Principals.Principal](KMS.Principals.Principal.md)
- [KMS.Principals.PrincipalFactor](KMS.Principals.PrincipalFactor.md)
- [KMS.RMK.AWS](KMS.RMK.AWS.md): AWS KMS-backed RMK provider.

- [KMS.RMK.GCP](KMS.RMK.GCP.md): Google Cloud KMS-backed RMK provider.

- [KMS.RMK.Local](KMS.RMK.Local.md): File-backed local RMK provider for development and tests.

- [KMS.RMK.StackIT](KMS.RMK.StackIT.md): StackIT KMS-backed RMK provider.

- [KMS.Repo.Postgres](KMS.Repo.Postgres.md)
- [KMS.Repo.SQLite](KMS.Repo.SQLite.md)
- [KMS.Schema](KMS.Schema.md)
- [KMS.Sessions](KMS.Sessions.md): Session creation and chained factor authentication.

- [KMS.Sessions.Session](KMS.Sessions.Session.md)
- [KMS.Utils.Passphrase](KMS.Utils.Passphrase.md): Backwards-compatible passphrase generator module.
- [KMS.WebAuthn.Challenge](KMS.WebAuthn.Challenge.md)
- [KMS.WebAuthn.Credential](KMS.WebAuthn.Credential.md)

- Public API
  - [KMS](KMS.md): Public facade for KMS encryption, identity, authorization, recovery, and WebAuthn APIs.
  - [KMS.Client](KMS.Client.md): Public KMS client facade.
  - [KMS.Client.Local](KMS.Client.Local.md): Local/in-process KMS client backend.
  - [KMS.Client.Remote](KMS.Client.Remote.md): HTTP KMS client backend.
  - [KMS.Crypto](KMS.Crypto.md): Small AES-GCM primitive module used by KMS and available for crypto-only mode.
  - [KMS.Passphrase](KMS.Passphrase.md): Generates human-friendly high-entropy passphrases for KMS passphrase workflows.
  - [KMS.RMK](KMS.RMK.md): Root master key facade.
  - [KMS.Signing](KMS.Signing.md): RMK-backed caller-process signing-key management and digest signing.
  - [KMS.Signing.Key](KMS.Signing.Key.md): RMK-wrapped asymmetric signing key metadata.

- Authentication
  - [KMS.Principals.Factors.OneTimeCode](KMS.Principals.Factors.OneTimeCode.md): Built-in high-entropy one-time code factor.
  - [KMS.Principals.Factors.TOTP](KMS.Principals.Factors.TOTP.md): RFC 6238 TOTP factor provider for authenticator applications.
  - [KMS.WebAuthn](KMS.WebAuthn.md): Server-side WebAuthn/passkey ceremony helpers.

- Operations
  - [KMS.API.Router](KMS.API.Router.md): Minimal JSON API for KMS remote clients.

  - [KMS.Telemetry](KMS.Telemetry.md): Vendor-neutral telemetry events and metric definitions for KMS.

## Mix Tasks

- [mix test.adapters](Mix.Tasks.Test.Adapters.md): Runs KMS/API tests with SQLite, then PostgreSQL.
- [mix test.postgresql](Mix.Tasks.Test.Postgresql.md): Runs KMS/API tests with `KMS_DATABASE_BACKEND=postgres`.
- [mix test.sqlite](Mix.Tasks.Test.Sqlite.md): Runs KMS/API tests with `KMS_DATABASE_BACKEND=sqlite`.

