> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.com/llms.txt
> Use this file to discover all available pages before exploring further.

> Learn how to enable Customer Managed Keys using the dashboard

# Configure Customer Managed Keys with the Dashboard

Auth0 secures your tenant secrets and data using an Auth0 Environment Root Key, at the top of the envelope encryption key hierarchy. The Auth0 Environment Root Key and Customer Provided Root Key are stored in the hardware security module (HSM) of the corresponding Auth0 Cloud Service Provider, AWS or Azure.

## Bring Your Own Key

Using Bring Your Own Key, users with the  [Key Management Editor role](/docs/get-started/manage-dashboard-access/add-dashboard-users) can use the <Tooltip tip="Auth0 Dashboard: Auth0's main product to configure your services." cta="View Glossary" href="/docs/glossary?term=Auth0+Dashboard">Auth0 Dashboard</Tooltip> to replace the default Auth0 Environment Root Key with their own Customer provided Root Key.

Customers can securely upload their own Root Key which contains their own cryptographic material to:

* Meet custom key generation and provenance requirements for the Environment Root Key.
* Meet specific key installation or lifespan requirements for the Environment Root Key.

<Warning>
  By importing your own Customer Provided Root Key with Bring Your Own Key, you are implicitly deauthorizing Auth0 from managing the lifecycle of the Customer Provided Root Key, except for its deletion.
</Warning>

To begin, go to Dashboard > Settings > Encryptions keys

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/cdy7uua7fh8z/1qmfCSl7cOugrHIAdxSyAt/6c7d7185920e61809d9423c8e3d4c4f2/Encryption_Keys_-_EN.png" alt="Dashboard > Settings > Encryption Keys" />
</Frame>

Select **Upload Key** to begin the import process for your Customer Provided Root Key. This will open the import dialog:

<Frame>
  <img src="https://mintlify.s3.us-west-1.amazonaws.com/auth0/docs/images/cdy7uua7fh8z/1GJPgT1Be7Wm6G6ldCVW4q/96e5a326aa643f29bb50aea76fce27aa/image__2_.png" alt="Dashboard > Settings > Encryption Keys > Upload" />
</Frame>

When you select **Upload Key** and then **Download,** it initiates the Bring Your Own Keys  process:

1. Creates a public wrapping key and downloads it to your system.
2. Take the public wrapping key and wrap your own cryptographic material with it using your own key management system to create a Wrapped Encryption Key (the Customer Provided Root Key).
3. Upload your Wrapped Encryption Key and select **Save**.

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  The Wrapped Encryption Key once uploaded replaces the Auth0 Environment Root Key in the hardware security module (AWS or Azure) as a Customer Provided Root key.
</Callout>

## Cryptographic material requirements

Use your key management system to wrap your own cryptographic material with the public wrapping key and create the Wrapped Encryption Key. Use these settings for the [CKM\_RSA\_AES\_KEY\_WRAP](https://docs.oasis-open.org/pkcs11/pkcs11-curr/v2.40/cos01/pkcs11-curr-v2.40-cos01.html#_Toc408226894) algorithm parameters based on your Auth0 Cloud Service Provider (AWS or Azure):

### Auth0 on AWS cloud

* Public wrapping key length: 3072 bits
* Algorithm: CKG\_MGF1\_SHA256
* Temporary AES key length for CKM\_AES\_KEY\_WRAP\_PAD: 256 bits
* Customer provided root key type: 256 bits long AES symmetric key

### Auth0 on Azure cloud

* Public wrapping key length: 2048 bits
* Algorithm: CKG\_MGF1\_SHA-1
* Temporary AES key length for CKM\_AES\_KEY\_WRAP\_PAD: 256 bits
* Customer Provided Root Key type: 2048 bits long RSA private key
* Private key encoding: PKCS #8 - ASN.1 DER