Integration

Azure Key Vault integration

Azure Key Vault REST API for managing secrets, cryptographic keys, and certificates. Securely store and access tokens, passwords, certificates, API keys, and other secrets with hardware-backed encryption.

Connect Azure Key Vault How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Azure Key Vault.Built from the 29 Azure Key Vault tools below, on the connection you add once.

Common Azure Key Vault use cases

automate operation management
enable or disable a key version
sign operation programmatically
verify operation programmatically
decrypt operation programmatically
enable or disable a secret version
encrypt operation programmatically
remove a credential from Key Vault
undo an accidental secret deletion
remove a certificate from Key Vault

What you can do with Azure Key Vault

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Key, 8 operations

create_keyCreate keyPOSTCreates a new key, stores it, and returns key parameters and attributes to the client. The create key operation can be used to create any key type in Azure Key Vault.
delete_keyDelete keyDELETEDeletes a key of any type from storage in Azure Key Vault. All versions of the key are deleted. If soft-delete is enabled, the key can be recovered.
get_keyGet keyGETGets the public part of a stored key. Returns key parameters and attributes.
import_keyImport keyPUTImports an externally created key and stores it in the vault. The import key operation supports importing any key type into Azure Key Vault.
list_keysList keysGETLists keys in the specified vault. Returns the key identifier and attributes for all keys in the vault.
unwrap_keyUnwrap keyPOSTUnwraps (decrypts) a symmetric key using the specified key. The UNWRAP operation is the inverse of the WRAP operation.
update_keyUpdate keyPATCHUpdates the properties associated with a specified key in a given key vault. Cannot update the key material.
wrap_keyWrap keyPOSTWraps (encrypts) a symmetric key using the specified key. The WRAP operation supports encryption of a symmetric key using a key encryption key.

Secret, 8 operations

backup_secretBackup secretPOSTRequests that a backup of the specified secret be downloaded to the client. All versions of the secret will be downloaded as an encrypted blob.
delete_secretDelete secretDELETEDeletes a secret from the specified key vault. Moves the secret to the deleted state. If soft-delete is enabled, the secret can be recovered.
get_latest_secretGet latest secretGETGet the latest version of a specified secret from a given key vault.
get_secretGet secretGETGet a specified secret version from a given key vault. Returns the secret value along with its attributes.
list_secretsList secretsGETList secrets in a specified key vault. Returns the identifier and attributes of all secrets. Does not include secret values.
restore_secretRestore secretPOSTRestores a backed-up secret and all its versions to a vault. The vault must be the same subscription as the original vault.
set_secretSet secretPUTSets a secret in a specified key vault. Creates a new secret version if the secret already exists.
update_secretUpdate secretPATCHUpdates the attributes associated with a specified secret in a given key vault. Cannot update the secret value; use Set Secret instead.

Certificate, 4 operations

create_certificateCreate certificatePOSTCreates a new certificate version. If this is the first version, the certificate resource is created.
delete_certificateDelete certificateDELETEDeletes all versions of a certificate object along with its associated policy. If soft-delete is enabled, the certificate can be recovered.
get_certificateGet certificateGETGets information about a certificate. Returns the certificate along with its policy and attributes.
list_certificatesList certificatesGETLists the certificates in a specified key vault. Returns the identifier and attributes of all certificates.

Deleted secret, 4 operations

get_deleted_secretGet deleted secretGETGets the specified deleted secret. Requires soft-delete to be enabled on the vault.
list_deleted_secretsList deleted secretsGETLists deleted secrets for the specified vault. Requires soft-delete to be enabled.
purge_deleted_secretPurge deleted secretDELETEPermanently deletes the specified secret. This operation is irreversible. Requires soft-delete to be enabled and the secret must be in a deleted state.
recover_deleted_secretRecover deleted secretPOSTRecovers the deleted secret to the latest version. Requires soft-delete to be enabled. The secret must be in a deleted but recoverable state.

Operation, 4 operations

decryptDecryptPOSTDecrypts a single block of encrypted data. The DECRYPT operation supports decryption of a single block of encrypted data.
encryptEncryptPOSTEncrypts an arbitrary sequence of bytes using an encryption key stored in Azure Key Vault.
signSignPOSTCreates a signature from a digest using the specified key. The SIGN operation is applicable to asymmetric and symmetric keys stored in Azure Key Vault.
verifyVerifyPOSTVerifies a signature using the specified key. The VERIFY operation is applicable to symmetric keys stored in Azure Key Vault.

Secret version, 1 operation

list_secret_versionsList secret versionsGETList all versions of the specified secret. Returns the identifier and attributes of all secret versions.

Use Azure Key Vault from Claude Code, Cursor or Codex

Connect Azure Key Vault in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Azure Key Vault operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Azure Key Vault

Create your workspace
Sign up free. Nothing to install.
Connect Azure Key Vault once
Add your Azure Key Vault connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Azure Key Vault integration FAQ

What can you do with the Azure Key Vault integration?

LiveContext exposes 29 operations on Azure Key Vault, covering key, secret, certificate and deleted secret. Common uses include automate operation management, enable or disable a key version and sign operation programmatically.