---
name: key-protect-regions
title: Regions and endpoints
description: Review region and connectivity options for interacting with IBM® Key Protect.
last-updated: 2026-06-11
---

{:shortdesc: .shortdesc}
{:screen: .screen}
{:pre: .pre}
{:table: .aria-labeledby="caption"}
{:external: target="_blank" .external}
{:codeblock: .codeblock}
{:tip: .tip}
{:note: .note}
{:important: .important}
{:deprecated: .deprecated}
{:term: .term}

# Regions and endpoints
{: #regions}

Review region and connectivity options for interacting with IBM® Key Protect.
{: shortdesc}

## Available regions
{: #available-regions}




Key Protect is available in the following regions. This map might not reflect actual political or geographic boundaries.
{: important}




![Regions where the Key Protect service is available.](images/world-map.svg){: caption="Displays the regions where you can create and manage Key Protect resources." caption-side="bottom"}

Access to the Chennai region is allowlisted. If this region is not available to you, open a [support ticket](https://www.ibm.com/mysupport/s/).
{: important}

[Key Protect Dedicated](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about) is currently only available in `us-south` (Dallas, Texas, United States), `us-east` (Washington, DC, United States), `eu-de` (Frankfurt, Germany), and `eu-es` (Madrid).
{: important}

 
You can create Key Protect resources in any supported IBM Cloud region, which represent the geographic area where your Key Protect requests are handled and processed. To learn more, see [Locations, tenancy, and availability](https://cloud.ibm.com/docs/key-protect?topic=key-protect-ha-dr#availability).

## Connectivity options
{: #connectivity-options}

Key Protect offers two connectivity options
for interacting with its service APIs.

### Public endpoints
{: #connectivity-options-public}

By default, you can connect to resources in your account over the IBM Cloud public network. Your data is encrypted in transit by using supported ciphers of the Transport Security Layer (TLS) 1.2 and 1.3 protocol. For more information about TLS and these ciphers, check out [Data encryption](https://cloud.ibm.com/docs/key-protect?topic=key-protect-security-and-compliance#data-encryption).

### Private endpoints
{: #connectivity-options-private}

For added benefits, you can also enable
[virtual routing and forwarding (VRF) and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint){: external}
for your infrastructure account.

When you enable VRF for your account, you can connect to
Key Protect by using a private IP that is
accessible only through the IBM Cloud private network.

To learn more about VRF, see
[Virtual routing and forwarding on IBM Cloud](https://cloud.ibm.com/docs/dl?topic=dl-overview-of-virtual-routing-and-forwarding-vrf-on-ibm-cloud){: external}.

To learn how to connect to Key Protect
by using a private endpoint, see
[Using private endpoints](https://cloud.ibm.com/docs/key-protect?topic=key-protect-private-endpoints).

## Service endpoints
{: #service-endpoints}

If you are managing your Key Protect
resources programmatically, see the following table to determine the API
endpoints to use when you connect to the
[Key Protect API](https://cloud.ibm.com/apidocs/key-protect){: external}.


| Region           | Public endpoints             |
| ---------------- | ---------------------------- |
| Dallas           | `us-south.kms.cloud.ibm.com` |
| Washington DC    | `us-east.kms.cloud.ibm.com`  |
| London           | `eu-gb.kms.cloud.ibm.com`    |
| Frankfurt        | `eu-de.kms.cloud.ibm.com`    |
| Sydney           | `au-syd.kms.cloud.ibm.com`   |
| Tokyo            | `jp-tok.kms.cloud.ibm.com`   |
| Osaka            | `jp-osa.kms.cloud.ibm.com`   |
| Toronto          | `ca-tor.kms.cloud.ibm.com`   |
| São-Paulo | `br-sao.kms.cloud.ibm.com`   |
| Madrid           | `eu-es.kms.cloud.ibm.com`   |
| Montreal         | `ca-mon.kms.cloud.ibm.com`  |
| Chennai - Airtel (allowlisted)         | `in-che.kms.cloud.ibm.com`  |
| Mumbai - Airtel  | `in-mum.kms.cloud.ibm.com`  |
{: caption="Lists public endpoints for interacting with Key Protect APIs over IBM Cloud's public network" caption-side="bottom"}
{: #table-1}
{: tab-title="Public"}
{: class="comparison-tab-table"}
{: row-headers}

| Region           | Private endpoints                            |
| ---------------- | -------------------------------------------- |
| Dallas           | `private.us-south.kms.cloud.ibm.com`         |
| Washington DC    | `private.us-east.kms.cloud.ibm.com`          |
| London           | `private.eu-gb.kms.cloud.ibm.com`            |
| Frankfurt        | `private.eu-de.kms.cloud.ibm.com`            |
| Sydney           | `private.au-syd.kms.cloud.ibm.com`           |
| Tokyo            | `private.jp-tok.kms.cloud.ibm.com`           |
| Osaka            | `private.jp-osa.kms.cloud.ibm.com`           |
| Toronto          | `private.ca-tor.kms.cloud.ibm.com`           |
| São-Paulo | `private.br-sao.kms.cloud.ibm.com`           |
| Madrid           | `private.eu-es.kms.cloud.ibm.com`           |
| Montreal         | `private.ca-mon.kms.cloud.ibm.com`          |
| Chennai - Airtel (allowlisted)         | `private.in-che.kms.cloud.ibm.com`           |
| Mumbai - Airtel  | `private.in-mum.kms.cloud.ibm.com`           |
{: caption="Lists private endpoints for interacting with Key Protect APIs over IBM Cloud's private network" caption-side="bottom"}
{: #table-2}
{: tab-title="Private"}
{: class="comparison-tab-table"}
{: row-headers}



For more information about authenticating with
Key Protect, see
[Accessing the API](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-api).