---
name: key-protect-retrieve-instance-id
title: Retrieving your instance ID and cloud resource name (CRN)
description: You can target an individual IBM® Key Protect instance for operations by including its unique identifier, or instance ID, in API requests to the service. Similarly, it can also be helpful to know your relevant cloud resource name (CRN).
last-updated: 2026-06-24
---

{:shortdesc: .shortdesc}
{:screen: .screen}
{:pre: .pre}
{:table: .aria-labeledby="caption"}
{:external: target="_blank" .external}
{:codeblock: .codeblock}
{:tip: .tip}
{:note: .note}
{:important: .important}
{:term: .term}
{:ui: .ph data-hd-interface='ui'}
{:api: .ph data-hd-interface='api'}
{:cli: .ph data-hd-interface='cli'}

# Retrieving your instance ID and cloud resource name (CRN)
{: #retrieve-instance-ID}

You can target an individual IBM® Key Protect instance for operations by including its unique identifier, or instance ID, in API requests to the service. Similarly, it can also be helpful to know your relevant [cloud resource name (CRN)](https://cloud.ibm.com/docs/account?topic=account-crn).
{: shortdesc}

## Viewing your instance ID and CRN in the IBM Cloud console
{: #view-instance-ID}
{: ui}

You can view the instance ID that is associated with your Key Protect instance by navigating to your IBM Cloud resource list.

1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login/){: external}.

2. Go to **Menu** > **Resource List**, and then click **Services** to browse a list of your cloud services.

3. Click the table row. This opens the resources table side panel, where you can see the CRN and instance GUID.

4. Click on the instance name link. This will open your Key Protect instance.

4. From the **Overview** page, find the **Instance** section. Your instance ID and CRN are listed here as code snippets.

## Retrieving an instance ID and CRN with the CLI
{: #retrieve-instance-ID-cli}
{: cli}

You can also retrieve the instance ID for your
Key Protect instance by using the
[IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started){: external}.

1. Log in to IBM Cloud with the
    [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started){: external}.

    ```sh
    ibmcloud login
    ```
    {: pre}

    If the login fails, run the `ibmcloud login --sso` command to try again. The
    `--sso` parameter is required when you log in with a federated ID. If this
    option is used, go to the link listed in the CLI output to generate a
    one-time passcode.
    {: note}

2. Select the account, region, and resource group that contain your provisioned
    instance of Key Protect.

3. Retrieve the Cloud Resource Name (CRN) that uniquely identifies your
    Key Protect instance.

    ```sh
    ibmcloud resource service-instance <instance_name> --id
    ```
    {: pre}

    Replace `<instance_name>` with the unique alias that you assigned to your
    Key Protect instance. If you do not know the name of your instance,
    run the [`ibmcloud resource service-instances` command](https://cloud.ibm.com/docs/cli?topic=cli-ibmcloud_commands_resource#ibmcloud_resource_service_instances) to retrieve a list of
    instance names that you provisioned in the selected region.

    The following truncated example shows the CLI output.

    ```plaintext
    crn:v1:bluemix:public:kms:us-south:a/f047b55a3362ac06afad8a3f2f5586ea:42454b3b-5b06-407b-a4b3-34d9ef323901:: 42454b3b-5b06-407b-a4b3-34d9ef323901
    ```
    {: screen}

    The _42454b3b-5b06-407b-a4b3-34d9ef323901_ value is an example instance ID.

## Retrieving an instance ID with the API
{: #retrieve-instance-ID-api}
{: api}

You might want to retrieve the instance ID programmatically to help you build
and connect your application. You can call the
[IBM Cloud Resource Controller API](https://cloud.ibm.com/apidocs/resource-controller){: external},
and then pipe the JSON output to `jq` to extract this value.

1. [Retrieve an IBM Cloud IAM access token](https://cloud.ibm.com/docs/key-protect?topic=key-protect-retrieve-access-token).

2. Call the
    [Resource Controller API](https://cloud.ibm.com/apidocs/resource-controller){: external}
    to retrieve your instance ID.

    ```sh
    $ curl -X GET \
        "https://resource-controller.cloud.ibm.com/v2/resource_instances" \
        -H "authorization: Bearer <IAM_token>" | jq -r '.resources[] | select(.name | contains("<instance_name>")) | .guid'
    ```
    {: codeblock}

    Replace `<instance_name>` with the unique alias that you assigned to your
    Key Protect instance. If you do not know the name of your instance,
    make a [`GET /v2/resource_instances` request](https://cloud.ibm.com/apidocs/resource-controller/resource-controller#list-resource-instances){: external}
    to retrieve a list of instance names that you provisioned in the selected region.

    The following output shows an example instance ID:

    ```plaintext
    42454b3b-5b06-407b-a4b3-34d9ef323901
    ```
    {: screen}