---
title: "Creates a signature from a digest using the specified key."
method: POST
path: "/keys/{key-name}/{key-version}/sign"
---

# Creates a signature from a digest using the specified key.

`POST /keys/{key-name}/{key-version}/sign`

The SIGN operation is applicable to asymmetric and symmetric keys stored in Azure Key Vault since this operation uses the private portion of the key. This operation requires the keys/sign permission.

## Path parameters

- `key-name` string, required
- `key-version` string, required

## Query parameters

- `api-version` string, required

## Request body

- KeySignParameters — The key operations parameters.
  - `alg` 'PS256' | 'PS384' | 'PS512' | 'RS256' | 'RS384' | 'RS512' | 'HS256' | 'HS384' | 'HS512' | 'RSNULL' | 'ES256' | 'ES384' | 'ES512' | 'ES256K', required — The signing/verification algorithm identifier. For more information on possible algorithm types, see JsonWebKeySignatureAlgorithm.
  - `value` string, base64url, required — The value to operate on.

## Response `200`

The request has succeeded.

- KeyOperationResult — The key operation result.
  - `kid` string — Key identifier
  - `value` string, base64url — The result of the operation.
  - `iv` string, base64url — Cryptographically random, non-repeating initialization vector for symmetric algorithms.
  - `tag` string, base64url — The tag to authenticate when performing decryption with an authenticated algorithm.
  - `aad` string, base64url — Additional data to authenticate but not encrypt/decrypt when using authenticated crypto algorithms.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-keys.md) · [All operations](https://skmtc.net/azure/apis/keyvault-keys/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-keys/revisions/7bedded21050/schema)