--- name: hs-crypto-set-up-cli title: Performing key management operations with the CLI - Standard Plan only description: IBM Cloud® Hyper Protect Crypto Services Standard Plan is integrated with IBM Key Protect command-line interface (CLI) plug-in, so that you can use the IBM Key Protect CLI plug-in to create, import, and manage encryption root keys and standard keys. last-updated: 2026-07-01 --- > ## Documentation Index > The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown > The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt > Use these files to discover more information as needed. # Performing key management operations with the CLI - Standard Plan only {: #set-up-cli} IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted. {: deprecated} IBM Cloud® Hyper Protect Crypto Services Standard Plan is integrated with IBM Key Protect command-line interface (CLI) plug-in, so that you can use the IBM Key Protect CLI plug-in to create, import, and manage encryption [root keys](#x6946961){: term} and standard keys. {: shortdesc} Currently, performing key management operations with the CLI is only supported with the Standard Plan. You can still perform key management operations for the Hyper Protect Crypto Services with Unified Key Orchestrator through the UI or API. {: note} Before you use the Key Protect CLI through a Hyper Protect Crypto Services instance (service instance for short), you need to perform the following steps: 1. Install the [IBM Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli&format=markdown#install-cli). 2. Set the KP_PRIVATE_ADDR environment variable on your workstation: - On the [Linux]{: tag-linux} operating system or [macOS]{: tag-macos}, run the following command: ``` export KP_PRIVATE_ADDR= ``` {: pre} In this command, the *URL* is the `Key management endpoint URL`. You can get the endpoint from your provisioned service instance dashboard through **Overview** > **Connect** > **Key management endpoint URL**. Or, you can dynamically [retrieve the API endpoint URL](https://cloud.ibm.com/apidocs/hs-crypto#getinstance){: external} with an API call. For example, ``` export KP_PRIVATE_ADDR="https://.api.us-south.hs-crypto.appdomain.cloud" ``` {: pre} To find out the regions that Hyper Protect Crypto Services supports, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown). - On the [Windows]{: tag-windows} operating system, in **Control Panel**, type `environment variable` in the search box to locate the Environment Variables window. Create a KP_PRIVATE_ADDR environment variable and set the value to the endpoint that is displayed on the **Manage** tab of your provisioned UI. For example, `https://.api.us-south.hs-crypto.appdomain.cloud`. You can also retrieve the endpoint URL through the API. For details, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto){: external}. Depending on whether you are using public or private endpoint, choose the corresponding endpoint URL to set the value of the KP_PRIVATE_ADDR environment variable. {: important} 3. Set the KP_INSTANCE_ID environment variable on your workstation: - On the [Linux]{: tag-linux} operating system or [macOS]{: tag-macos}, run the following command: ``` export KP_INSTANCE_ID= ``` {: pre} In this command, the *instance_ID* is displayed on the **Manage** tab of your provisioned UI. *instance_ID* is in a Universally Unique Identifier (UUID) format. - On [Windows]{: tag-windows}, in **Control Panel**, type `environment variable` in the search box to locate the Environment Variables window. Create a KP_INSTANCE_ID environment variable and set the value to the instance ID value that is displayed on the **Manage** tab of your provisioned Hyper Protect Crypto Services dashboard. Alternatively, you can use the `-i ` option on the `ibmcloud kp` command to set the instance ID. 4. Run the specific command to perform key management operations. For the full list of commands, check out the [key management CLI reference](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference&format=markdown). 5. [Upgrade the Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli&format=markdown#update-cli) to the newest version to enable new features. 6. (Optional) If you don't need the plug-in any more, you can [uninstall the Key Protect CLI plug-in](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli&format=markdown#uninstall-cli). ## What's next {: #cli-next-steps} - You can also perform key management operations with API calls, check out [Managing your keys with the key management service API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-kms-api&format=markdown). - To find out more about encrypting your data by using the cloud HSM function of Hyper Protect Crypto Services, check out the [PKCS #11 API reference](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref&format=markdown) and [GREP11 API reference doc](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref&format=markdown).