---
name: hs-crypto-virtual-private-endpoint
title: Using virtual private endpoints for VPC to privately connect to Hyper Protect Crypto Services
description: IBM Cloud® Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC) enables you to connect to Hyper Protect Crypto Services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.
last-updated: 2026-07-01
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/hs-crypto?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Using virtual private endpoints for VPC to privately connect to Hyper Protect Crypto Services
{: #virtual-private-endpoints-for-vpc}

IBM Cloud® Hyper Protect Crypto Services is deprecated. As of 28 March 2026, you can't create new instances, and access to free instances will be removed. Existing premium plan instances are supported until 28 March 2027. Any instances that still exist on that date will be deleted.
{: deprecated}

IBM Cloud® Virtual Private Endpoints (VPE) for Virtual Private Cloud (VPC) enables you to connect to Hyper Protect Crypto Services from your VPC network by using the IP addresses of your choosing, allocated from a subnet within your VPC.
{: shortdesc}

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all availability zones of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud® service on the private backbone. VPE for VPC gives you the experience of controlling all the private addressing within your cloud. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).

To connect to Hyper Protect Crypto Services by using a virtual private endpoint, you must use the Hyper Protect Crypto Services API, CLI, or Terraform. The Hyper Protect Crypto Services UI needs to be accessed through the public network from your VPC.
{: note}

## Before you begin
{: #virtual-private-endpoints-for-vpc-prereqs}

Before you target a virtual private endpoint for Hyper Protect Crypto Services, you must complete the following tasks:

- Ensure that you have [provisioned a Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown).
- Make a [plan for your virtual private endpoints](https://cloud.ibm.com/docs/vpc?topic=vpc-planning-considerations&format=markdown).
- Ensure that correct access controls are set for your virtual private endpoint.
- Understand the [limitations](https://cloud.ibm.com/docs/vpc?topic=vpc-limitations-vpe&format=markdown) of having a virtual private endpoint.
- Understand how to [view details](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown) about a virtual private endpoint.

## Setting up a VPE for Hyper Protect Crypto Services
{: #virtual-private-endpoints-for-vpc-setup}

When you create a VPE gateway by using the CLI or API, you must specify the [Cloud Resource Name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn&format=markdown) of the region in which you want to connect to Hyper Protect Crypto Services. Review the following table for the available regions and CRNs to create your VPE gateways.

 


| Feature | Supported Endpoints | CRN |
| --- | --- | --- |
| Key Management Service | api.private.au-syd.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:au-syd:::endpoint:<instance_ID>.api.private.au-syd.hs-crypto.appdomain.cloud<br>api.private.eu-de.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-de:::endpoint:<instance_ID>.api.private.eu-de.hs-crypto.appdomain.cloud<br>api.private.us-east.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-east:::endpoint:<instance_ID>.api.private.us-east.hs-crypto.appdomain.cloud<br>api.private.us-south.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-south:::endpoint:<instance_ID>.api.private.us-south.hs-crypto.appdomain.cloud<br>api.private.eu-gb.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-gb:::endpoint:<instance_ID>.api.private.eu-gb.hs-crypto.appdomain.cloud<br>api.private.jp-tok.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:jp-tok:::endpoint:api.private.jp-tok.hs-crypto.appdomain.cloud<br>api.private.eu-es.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-es:::endpoint:api.private.eu-es.hs-crypto.appdomain.cloud<br>api.private.br-sao.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:br-sao:::endpoint:api.private.jbr-sao.hs-crypto.appdomain.cloud<br>api.private.ca-tor.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:ca-tor:::endpoint:api.private.ca-tor.hs-crypto.appdomain.cloud |
| Enterprise PKCS #11 (EP11) | <instance_ID>.ep11.private.au-syd.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:au-syd:::endpoint:<instance_ID>.ep11.private.au-syd.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.eu-de.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-de:::endpoint:<instance_ID>.ep11.private.eu-de.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.us-east.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-east:::endpoint:<instance_ID>.ep11.private.us-east.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.us-south.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-south:::endpoint:<instance_ID>.ep11.private.us-south.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.eu-gb.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-gb:::endpoint:ep11.vpc.private.eu-gb.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.jp-tok.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:jp-tok:::endpoint:ep11.vpc.private.jp-tok.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.eu-es.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-es:::endpoint:ep11.vpc.private.eu-es.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.br-sao.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:br-sao:::endpoint:ep11.vpc.private.jbr-sao.hs-crypto.appdomain.cloud<br><instance_ID>ep11.private.ca-tor.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:ca-tor:::endpoint:ep11.vpc.private.ca-tor.hs-crypto.appdomain.cloud |
| Trusted Key Entry (TKE) | <instance_ID>tke.private.au-syd.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:au-syd:::endpoint:tke.private.au-syd.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.eu-de.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-de:::endpoint:tke.private.eu-de.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.us-east.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:us-east:::endpoint:tke.private.us-east.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.us-south.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:us-south:::endpoint:tke.private.us-south.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.eu-gb.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-gb:::endpoint:tke.vpc.private.eu-gb.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.jp-tok.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:jp-tok:::endpoint:tke.vpc.private.jp-tok.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.eu-es.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-es:::endpoint:tke.vpc.private.eu-es.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.br-sao.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:br-sao:::endpoint:tke.vpc.private.jbr-sao.hs-crypto.cloud.ibm.com<br><instance_ID>tke.private.ca-tor.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:ca-tor:::endpoint:tke.vpc.private.ca-tor.hs-crypto.cloud.ibm.com |
| Key Management Interoperability Protocol (KMIP) adapter | <instance_ID>kmip.private.au-syd.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:au-syd:::endpoint:<instance_ID>.kmip.private.au-syd.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.eu-de.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-de:::endpoint:<instance_ID>.kmip.private.eu-de.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.us-east.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-east:::endpoint:<instance_ID>.kmip.private.us-east.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.us-south.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:us-south:::endpoint:<instance_ID>.kmip.private.us-south.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.eu-gb.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-gb:::endpoint:kmip.private.eu-gb.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.jp-tok.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:jp-tok:::endpoint:kmip.private.jp-tok.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.eu-es.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:eu-es:::endpoint:kmip.private.eu-es.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.br-sao.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:br-sao:::endpoint:kmip.private.jbr-sao.hs-crypto.appdomain.cloud<br><instance_ID>kmip.private.ca-tor.hs-crypto.appdomain.cloud : crn:v1:bluemix:public:hs-crypto:ca-tor:::endpoint:kmip.private.ca-tor.hs-crypto.appdomain.cloud |
| Certificate Manager Server | <instance_ID>cert-mgr.private.au-syd.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:au-syd:::endpoint:cert-mgr.private.au-syd.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.eu-de.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-de:::endpoint:cert-mgr.private.eu-de.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.us-east.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:us-east:::endpoint:cert-mgr.private.us-east.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.us-south.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:us-south:::endpoint:cert-mgr.private.us-south.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.eu-gb.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-gb:::endpoint:cert-mgr.private.eu-gb.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.jp-tok.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:jp-tok:::endpoint:cert-mgr.private.jp-tok.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.eu-es.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:eu-es:::endpoint:cert-mgr.private.eu-es.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.br-sao.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:br-sao:::endpoint:cert-mgr.private.jbr-sao.hs-crypto.cloud.ibm.com<br><instance_ID>cert-mgr.private.ca-tor.hs-crypto.cloud.ibm.com : crn:v1:bluemix:public:hs-crypto:ca-tor:::endpoint:cert-mgr.private.ca-tor.hs-crypto.cloud.ibm.com | 
{: caption="Table 1: Available region endpoints and CRNs for creating VPE gateways" caption-side="bottom"}



### Configuring an endpoint gateway
{: #vpe-gateway-configure-for-hpcs}

To configure a virtual private endpoint gateway, follow these steps:

1. List the available services, including IBM Cloud infrastructure services available (by default) for all VPC users.
2. [Create an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&format=markdown) for your Hyper Protect Crypto Services instance that you want to be privately available to the VPC.

    If you are creating a VPE gateway by using the [UI](https://cloud.ibm.com/infrastructure){: external}, perform the following steps:

    1. Select the **Menu** icon ![Menu icon](../icons/icon_hamburger.svg "Menu"), and then click **VPC Infrastructure > Virtual private endpoint gateways** in the Network section, and then click **Create**. The **New virtual private endpoint gateway for VPC** page is displayed.
    2. In the **Cloud service** section, enable your Hyper Protect Crypto Services instance:

        - Under **Cloud service offerings**, select **Hyper Protect Crypto Services**.
        - Under **Cloud service regions**, verify the corresponding [region](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown#available-regions) is pre-filled for your provisioned Hyper Protect Crypto Services instance.
        - Select the [private endpoint](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions&format=markdown#service-endpoints) that you are going to use to connect with your VPC instance.
            If you are connecting to an EP11 private endpoint, make sure that you select all EP11 private endpoints for all available zones.
            {: important} 

3. [Bind a reserved IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-bind-unbind-reserved-ip&format=markdown) to the endpoint gateway.
4. View the created VPE gateways associated with the Hyper Protect Crypto Services instance. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).

Now your virtual server instances in the VPC can access your Hyper Protect Crypto Services instance privately through it.

## Using your VPE for Hyper Protect Crypto Services
{: #use-vpe-for-hpcs}

After you create an endpoint gateway for your Hyper Protect Crypto Services instance, follow these steps to use private endpoints.

### Using the VPE with the CLI
{: #use-vpe-for-hpcs-cli}
{: cli}

- Using the VPE for the [TKE CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-hpcs-cli-plugin&format=markdown#tke-cli-plugin)

    1. Update the TKE CLI plug-in to the latest version with the following command:

        ```
        ibmcloud plugin update tke
        ```
        {: pre}

    2. To initialize service instances with the TKE CLI plug-in, set the TKE_PRIVATE_ADDR environment variable to target the TKE private endpoint:

        ```
        export TKE_PRIVATE_ADDR=https://tke.private.<region>.hs-crypto.cloud.ibm.com
        ```
        {: pre}

- Using the VPE for the [Key Protect CLI plug-in](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-hpcs-cli-plugin&format=markdown#kp-cli-plugin)

    1. Update the Key Protect CLI plug-in to the latest version with the following command:

        ```
        ibmcloud plugin update key-protect -r "IBM Cloud"
        ```
        {: pre}

    2. To perform key management operations with the Key Protect CLI plug-in, set the KP_PRIVATE_ADDR environment variable to target the key management service private endpoint:

        ```
        export KP_PRIVATE_ADDR=https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud
        ```
        {: pre}

### Using the VPE with the API
{: #use-vpe-for-hpcs-api}
{: api}

- Using the VPE for the [key management service API](https://cloud.ibm.com/apidocs/hs-crypto)

    To perform key management operations with the key management service API, use the key management service private endpoints in the API request URL to access the service. For example,

    ```
    curl GET \
      https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud/api/v2/keys   \
      -H 'authorization: Bearer <IAM_token>'   \
      -H 'bluemix-instance: <instance_ID>'   \
      -H 'accept: application/vnd.ibm.kms.key+json'
    ```
    {: codeblock}

- Using the VPE for the [PKCS #11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-pkcs11-api-ref&format=markdown)

    To perform cryptographic operations with the PKCS #11 API, set the `address` field to the EP11 private endpoint in the configuration file. For more information, see [Set up the PKCS #11 configuration file](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-pkcs-api&format=markdown#step3-setup-configuration-file).

- Using the VPE for the [GREP11 API](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-grep11-api-ref&format=markdown)

    To perform cryptographic operations with the GREP11 API, specify the server address with the EP11 private endpoint in the code. For more information, see [Generating a GREP11 API request](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-set-up-grep11-api&format=markdown#form-grep11-api-request).

### Using the VPE with Terraform
{: #use-vpe-for-hpcs-terraform}
{: terraform}

To use VPE with Terraform, set the `service_endpoints` parameter to `private-only` in the resource block. For more information, see [Setting up Terraform for Hyper Protect Crypto Services](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-terraform-setup-for-hpcs&format=markdown).

- If you plan to use private endpoints to initialize your service instance, make sure to set the `IBMCLOUD_HPCS_TKE_ENDPOINT` environment variable to target the TKE private endpoint. For example,:

    ```
    export IBMCLOUD_HPCS_TKE_ENDPOINT=https://tke.private.<region>.hs-crypto.cloud.ibm.com
    ```
    {: pre}

- If you plan to use private endpoints to manage your key management service keys, make sure to set the `IBMCLOUD_KP_API_ENDPOINT` environment variable to target the key management service private endpoint. For example,:

    ```
    export IBMCLOUD_KP_API_ENDPOINT=https://<instance_ID>.api.private.<region>.hs-crypto.appdomain.cloud
    ```
    {: pre}