Setting up the CLI

You can use the IBM Key Protect CLI plug-in to help you create, import, and manage encryption keys.

To find out more about using the Key Protect CLI plug-in, check out the Key Protect CLI reference doc.

Installing the Key Protect CLI plug-in

Before you can set up the Key Protect CLI plug-in, install the IBM Cloud CLI.

To install the CLIs:

Install the IBM Cloud CLI.

After you install the CLI, you can run ibmcloud commands to interact with your cloud services.
Log in to IBM Cloud.
```
ibmcloud login
```
If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
To start managing encryption keys, install the Key Protect CLI plug-in.
```
ibmcloud plugin install key-protect -r "IBM Cloud"
```
Set the region to target a specific Key Protect endpoint.
```
ibmcloud kp region-set -i <INSTANCE_ID>
```
Replace <INSTANCE_ID> with the instance ID representing your Key Protect. Learn more about your instance, including choosing regions, at Provisioning the Key Protect service.

You will be prompted to choose from a list as shown in the results.
```
Select a Region:
    1. au-syd
    2. eu-de
    3. eu-gb
    4. jp-osa
    5. jp-tok
    6. us-east
    7. us-south
    8. staging (us-south)
    Enter a number:
```
After you select your region, you can start working with your instance.
Optional: Verify that the plug-in was installed successfully.
```
ibmcloud plugin list
```

Updating the Key Protect CLI plug-in

For best practices, you might choose to update CLI periodically to use new features.

To update the CLI:

Log in to IBM Cloud with the IBM Cloud CLI.
```
ibmcloud login
```
If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
Install the update from the plug-in repository.
```
ibmcloud plugin update key-protect 
```

Optional: Verify that the plug-in was updated successfully.

ibmcloud plugin list

The results should show the version and the status of the plugins, as well as properties about the plugins, like whether "Private endpoints" are supported.


Plugin Name                             Version   Status             Private endpoints supported   
cloud-functions[wsk/functions/fn]       1.0.49    Update Available   false   
cloud-object-storage                    1.2.4     Update Available   false   
container-registry                      0.1.541   Update Available   true   
container-service[kubernetes-service]   1.0.233   Update Available   false   
key-protect                             0.6.8                        true   
sdk-gen                                 0.1.12                       false

Uninstalling the Key Protect CLI plug-in

Log in to IBM Cloud with the IBM Cloud CLI.
```
ibmcloud login
```
If the login fails, run the ibmcloud login --sso command to try again. The --sso parameter is required when you log in with a federated ID. If this option is used, go to the link listed in the CLI output to generate a one-time passcode.
Install the update from the plug-in repository.
```
ibmcloud plugin uninstall key-protect
```
Optional: Verify that the plug-in was uninstalled successfully.
```
ibmcloud plugin list
```