---
name: hs-crypto-initialize-hsm-prerequisite
title: Before you begin
description: 'Before you can initialize your service instance, make sure that you have done the following:'
last-updated: 2026-07-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Before you begin
{: #initialize-hsm-prerequisite}

IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted.
{: deprecated}

Before you can initialize your service instance, make sure that you have done the following:
{: shortdesc}

1. Install the latest version of [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-install-ibmcloud-cli&format=markdown){: external}.

2. Install the latest Trusted Key Entry (TKE) CLI plug-in with the following command:

    ```
    ibmcloud plugin install tke
    ```
    {: pre}

    If you have installed the TKE CLI plug-in, make sure to update your plug-in to the latest version with the following command:

    ```
    ibmcloud plugin update tke
    ```
    {: pre}

3. Set the environment variable `CLOUDTKEFILES` on your workstation to specify the directory where you want to save master key part files and signature key files. The signature keys are used to sign TKE administrative commands. Make sure that the directory exists before you set the environment variable.

    - On the [Linux]{: tag-linux} operating system or [macOS]{: tag-macos}, add the following line to the `.bash_profile` file:

        ```
        export CLOUDTKEFILES=<path>
        ```
        {: pre}

        For example, you can specify the *path* to `/Users/tke-files`.

     - On [Windows]{: tag-windows}, in **Control Panel**, type `environment variable` in the search box to locate the Environment Variables window. Create a `CLOUDTKEFILES` environment variable, set the value to the path for storing key files (For example, `C:\users\tke-files`), and restart your computer.

    The TKE_PRIVATE_ADDR environment variable is used to set the API endpoint URL both for public endpoint and private endpoint. If you want to use the public endpoint, unset the TKE_PRIVATE_ADDR environment variable or set the TKE_PRIVATE_ADDR environment variable as the public endpoint URL: `https://tke.<region>.hs-crypto.cloud.ibm.com`.
    {: important}

4. Log in to IBM Cloud with the CLI with the following command:
    
    ```
    ibmcloud login
    ```
    {: pre}

    If you have multiple accounts, select the account that your service instance is created with. Make sure that you're logged in to the correct region and resource group where the service instance locates with the following command:

    ```
    ibmcloud target -r <region> -g <resource_group>
    ```
    {: pre}

    To find out the regions that Hyper Protect Crypto Services supports, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown).

## What's next
{: #initialize-hsm-prerequisite-whats-next}

Depending on your business needs and security requirements, Hyper Protect Crypto Services provides you with three options to initialize your service instance. For detailed operation steps, see:
- [Initializing service instances by using recovery crypto units](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-recovery-crypto-unit&format=markdown)
- [Initializing service instances by using key part files](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm&format=markdown)
- [Initializing service instances by using smart cards and the Management Utilities](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-initialize-hsm-management-utilities&format=markdown)