# KMS

URL: https://docs.hanzo.ai/docs/cli/kms

> The `hanzo kms` commands.

Also for this capability: [API](https://docs.hanzo.ai/docs/openapi/kms) · **CLI** · [MCP](https://docs.hanzo.ai/docs/mcp-tools/kms) · [SDKs](https://docs.hanzo.ai/docs/sdks)

Secret custody: your org's secrets sealed at rest, plus threshold signing.

[API reference →](https://docs.hanzo.ai/docs/openapi/kms)

```bash
hanzo kms config
```

Every command takes `--json` for the raw response and `--help` for its own flags. Sign in once with `hanzo auth login`; the commands below use that session, and the org they act in is the one it carries.

| Command            | What it does                                            |
| ------------------ | ------------------------------------------------------- |
| `hanzo kms config` | Returns the runtime configuration for the KMS console.  |
| `hanzo kms health` | Reports whether this broker can actually serve secrets. |

### Auth

| Command                | What it does                                            |
| ---------------------- | ------------------------------------------------------- |
| `hanzo kms auth login` | Exchanges a machine credential for an IAM bearer token. |

### Secrets

| Command                    | What it does                                            |
| -------------------------- | ------------------------------------------------------- |
| `hanzo kms secrets create` | Stores or replaces one secret in your org.              |
| `hanzo kms secrets get`    | Lists the secrets your org holds, without their values. |