---
name: key-protect-crypto-unit-states
title: Crypto unit states
description: When you provision a Key Protect instance, the crypto units that are associated with your instance go through a series of states before they are ready to use. Understanding these states helps you track the initialization progress and troubleshoot any issues.
last-updated: 2026-08-11
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/key-protect?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Crypto unit states
{: #crypto-unit-states}

When you provision a Key Protect instance, the crypto units that are associated with your instance go through a series of states before they are ready to use. Understanding these states helps you track the initialization progress and troubleshoot any issues.
{: shortdesc}

## Checking crypto unit state
{: #check-crypto-unit-state}

To check the state of your crypto units, run the [`kp crypto-units`](https://cloud.ibm.com/docs/key-protect?topic=key-protect-key-protect-cli-reference&format=markdown#kp-crypto-units) command.

## Crypto unit state definitions
{: #crypto-unit-state-definitions}

The following table describes the different states that a crypto unit can be in and the recommended next steps for each state.

| State | Description | Recommended next step |
|-------|-------------|----------------------|
| `reserved` | The crypto unit is uninitialized. This is the initial state when you first provision an instance. The crypto unit must be fully initialized to enable Key Protect operations. | Follow the [initialization documentation](https://cloud.ibm.com/docs/key-protect?topic=key-protect-st-init-cli&interface=cli&format=markdown) in its entirety. |
| `claimed` | The crypto unit has been [claimed](https://cloud.ibm.com/docs/key-protect?topic=key-protect-st-init-cli&interface=cli&format=markdown#getting-started-claim-crypto-units). The crypto unit is not yet fully initialized to support Key Protect operations. | [Upload the master key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-st-init-cli&interface=cli&format=markdown#getting-started-master-key) and permit the `kmsCryptoUser` identity. |
| `initialized` | The master key has been [uploaded](https://cloud.ibm.com/docs/key-protect?topic=key-protect-st-init-cli&interface=cli&format=markdown#getting-started-master-key) to the crypto unit. The crypto unit is not yet fully initialized to support Key Protect operations. | Permit the `kmsCryptoUser` identity to complete initialization. |
| `kms-authorized` | The `kmsCryptoUser` identity has been permitted to the crypto unit. The crypto unit is not yet fully initialized to support Key Protect operations. | [Upload the master key](https://cloud.ibm.com/docs/key-protect?topic=key-protect-st-init-cli&interface=cli&format=markdown#getting-started-master-key) to complete initialization. |
| `kms-initialized` | The crypto unit is fully initialized and ready for use with Key Protect operations. | No action required. Note that it might take a few minutes after reaching this state for operations to become available. |
| `maintenance` | The Key Protect service team is performing maintenance, upgrades, or security patches on the hardware backing the crypto unit. A crypto unit in maintenance state is not used for operations. | No action required. Wait for maintenance to complete. During this period, instances under high request load might experience minor performance degradation. |
{: caption="Table 1. Crypto unit states" caption-side="bottom"}

## Understanding the kmsCryptoUser identity
{: #kms-crypto-user}

The `kmsCryptoUser` identity is used by your Key Protect instance to perform operations. Each instance has a unique `kmsCryptoUser` identity.

## Maintenance state considerations
{: #maintenance-considerations}

When a crypto unit enters the maintenance state, keep the following considerations in mind:

* No more than one crypto unit of an instance is placed in maintenance state at any given time.
* If your instance has only one crypto unit in `kms-initialized` state and it moves into maintenance state, Key Protect operations are not available.
* Maintenance on crypto unit hardware proceeds regardless of whether a crypto unit is the only `kms-initialized` crypto unit in the instance.
* You cannot control or prevent crypto unit hardware maintenance.

## Best practices
{: #crypto-unit-best-practices}

Follow these best practices to ensure optimal performance and availability:

* You must have at least one crypto unit in `kms-initialized` state for Key Protect operations to be available.
* Initialize all crypto units in your instance to `kms-initialized` state for maximum performance and resiliency.
* Provision at least two crypto units for your instance to maintain availability during maintenance windows. The minimum number of crypto units you can provision is two.
* If you expect your instance to experience heavy request loads, consider provisioning a three crypto unit instance. Remember that the number of crypto units assigned to an instance cannot be changed after provisioning.

## Master key requirements
{: #master-key-requirements}

Master keys must be of the same material for proper operation. Initializing crypto units with mismatched master keys causes the service to return `HTTP 500 Internal Server Error` or `HTTP 503 no healthy upstream` errors.