> For the complete documentation index, see [llms.txt](https://docs.envector.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.envector.io/1.5.x/sdk-user-guide/initialize/key-config.md).

# Key Configuration

These initialize-time (`ev.init`) settings control the key directory and sealing options for the keys used for data encryption and security.

> This page is the init-parameter reference for the **client-managed** key workflow. For the full key story — client-managed vs. KMS-managed [Managed KMS](/1.5.x/key-management/managed-kms.md) — see the [Key Management](/1.5.x/key-management/key-management.md) section. Key generation and server-side registration are covered in [Client-Managed Keys](/1.5.x/key-management/client-managed-keys.md).

* `auto_key_setup` (bool, default: `True`) This parameter automates the key generation and registration workflow.
  * If `True`: The SDK handles everything automatically. It checks for keys at the specified path. If they don't exist, it generates a new key set and registers the public keys with the server. This is the recommended mode for most users.
  * If `False`: This is a manual mode for advanced use cases. The SDK requires a pre-existing key set at the specified path and will raise an error if one is not found. Key generation and registration must be performed separately by the user.
* `key_path` (str) The base directory where all encryption key sets are stored. Each key set will be in a subdirectory named after its `key_id`. This path should be considered fixed after the initial client setup.
* `key_id` (str) A unique identifier for a specific set of encryption keys. While the system is designed to eventually support multiple key IDs for different indexes, the current version only supports using a single `key_id` per client instance.
* `metadata_encryption` (bool, default: `True`) Determines whether to encrypt metadata before sending it to the server. When set to `True`, a `MetadataKey.json` is automatically generated and used for this purpose.
* `seal_mode` (str, default: `'none'`) Enables at-rest encryption for your most sensitive keys. When set to `'aes'`, the `SecKey.json` and `MetadataKey.json` (if it exists) are "sealed" (encrypted) using a Key Encryption Key (KEK) for secure storage.
  * `'aes'`: Activates AES256-GCM sealing.
  * `'none'`: Disables sealing.
* `seal_kek_path` (str) Required only when `seal_mode` is set to `'aes'`. This parameter specifies the file path to the Key Encryption Key (KEK) that will be used to seal your keys.
* `key_store` (str, optional) Switch between filesystem-backed keys (`"local"`, default) and AWS-backed storage (`"aws"`). When set to `"aws"`, the SDK uploads/loads key material directly to/from AWS services instead of using `key_path`.
* `region_name`, `bucket_name`, `secret_prefix` (str, optional) Required when `key_store="aws"`. Set the AWS region, the S3 bucket that stores encryption/eval keys, and the AWS Secrets Manager prefix for Sec/Metadata keys.

> When `key_store="aws"`, keys are generated in memory and stored in Amazon S3 (public keys) + AWS Secrets Manager (secret keys) instead of on disk. Setup, IAM permissions, and CLI/Python examples are covered in [AWS-Backed Key Storage](/1.5.x/key-management/client-managed-keys/aws-key-storage.md).

## Related — Key Management

This page covers only the init-time parameters. For the full picture, see the [Key Management](/1.5.x/key-management/key-management.md) section:

* [Key Management Overview](/1.5.x/key-management/key-management.md) — the keys (`SecKey`/`EncKey`/`EvalKey`/`MetadataKey`) and the two management models
* **Client-Managed Keys** (the model these parameters configure)
  * [Key Generation](/1.5.x/key-management/client-managed-keys/key-generation.md) — generate a key set, storage options, KEK sealing
  * [Key Registration & Deletion](/1.5.x/key-management/client-managed-keys/key-registration.md) — server-side register/activate and remove keys
  * [AWS-Backed Key Storage](/1.5.x/key-management/client-managed-keys/aws-key-storage.md) — store keys in S3 + Secrets Manager
* **Managed KMS** (KMS-managed alternative)
  * [KMS Architecture](/1.5.x/key-management/managed-kms.md) — design and key hierarchy
  * [KMS Operations](/1.5.x/key-management/managed-kms/kms.md) — status, unseal, key generation
  * [Key Rotation & Incident Response](/1.5.x/key-management/managed-kms/key-rotation.md)
  * [KMSClient API](/1.5.x/api-reference/kms.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.envector.io/1.5.x/sdk-user-guide/initialize/key-config.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.