# hardhat-kms > Sign Hardhat 3 transactions, messages and typed data with keys in AWS KMS, Google Cloud KMS or Azure Key Vault. ## Start here for agents Install the core and the provider package for the cloud that holds the key, add the plugin and the key to `hardhat.config.ts` ([configuration reference](https://aelmanaa.github.io/hardhat-kms/user/reference/configuration.md)) and list the key's address with `npx hardhat kms accounts`: ```sh npm install --save-dev hardhat-kms @hardhat-kms/aws # AWS KMS npm install --save-dev hardhat-kms @hardhat-kms/gcp # Google Cloud KMS npm install --save-dev hardhat-kms @hardhat-kms/azure # Azure Key Vault npx hardhat kms accounts ``` These packages are newer than most training data: check npm for the current version (`npm view hardhat-kms version`) instead of guessing one. [Install hardhat-kms](https://aelmanaa.github.io/hardhat-kms/user/guides/install-before-release.md) gives the pnpm and Yarn commands and the settings each needs. Credentials never come from the Hardhat config: AWS and Google Cloud use their SDK's credential discovery, and Azure uses the plugin's own chain. To give a coding agent the plugin's skill: `npx skills add aelmanaa/hardhat-kms`. ## Table of Contents ### Tutorials - [Deploy a Hardhat contract to Sepolia with AWS KMS](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-aws.md): Deploy a Hardhat 3 contract to Sepolia with AWS KMS: create a secp256k1 key, sign the deployment with it, verify the source and clean up. - [Deploy a Hardhat contract to Sepolia with Google Cloud KMS](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-gcp.md): Deploy a Hardhat 3 contract to Sepolia with Google Cloud KMS: create an HSM secp256k1 key, deploy from it, verify the source and destroy it. - [Deploy a Hardhat contract to Sepolia with Azure Key Vault](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-azure.md): Sign Hardhat transactions with Azure Key Vault: create a P-256K key, deploy a contract to Sepolia from it, verify the source and purge the key. - [Deploy a Hardhat contract to Sepolia with AWS KMS](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-aws.md): Deploy a Hardhat 3 contract to Sepolia with AWS KMS: create a secp256k1 key, sign the deployment with it, verify the source and clean up. - [Deploy a Hardhat contract to Sepolia with Google Cloud KMS](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-gcp.md): Deploy a Hardhat 3 contract to Sepolia with Google Cloud KMS: create an HSM secp256k1 key, deploy from it, verify the source and destroy it. - [Deploy a Hardhat contract to Sepolia with Azure Key Vault](https://aelmanaa.github.io/hardhat-kms/user/tutorials/first-deploy-azure.md): Sign Hardhat transactions with Azure Key Vault: create a P-256K key, deploy a contract to Sepolia from it, verify the source and purge the key. ### How-to guides - [Deploy with Hardhat Ignition](https://aelmanaa.github.io/hardhat-kms/user/guides/deploy-with-ignition.md): Hardhat Ignition with a KMS signer: choose the deployer, rehearse on a simulated network, deploy, resume after a KMS failure, and verify the source. - [Sign from GitHub Actions with OIDC](https://aelmanaa.github.io/hardhat-kms/user/guides/github-actions-oidc.md): Let a GitHub Actions job sign with an AWS KMS, Google Cloud KMS or Azure Key Vault key over OIDC, with no cloud credential stored in GitHub. - [Recover from an uncertain transaction send](https://aelmanaa.github.io/hardhat-kms/user/guides/uncertain-sends.md): After a KMS send with no clear answer, or one that is not mined: look it up, compare the pending and latest counts, then wait or fill a nonce. - [Find who signed with a key](https://aelmanaa.github.io/hardhat-kms/user/guides/who-signed.md): hardhat kms history: who signed, from CloudTrail, Cloud Audit Logs or Azure Monitor - [Verify a release](https://aelmanaa.github.io/hardhat-kms/user/guides/verify-a-release.md): Check that the hardhat-kms packages you installed were built from a signed tag of this repository, with npm audit signatures, provenance and the tarball files. - [Install hardhat-kms](https://aelmanaa.github.io/hardhat-kms/user/guides/install-before-release.md): Install hardhat-kms and a provider package with npm, pnpm or Yarn, register the plugin in hardhat.config.ts and check that Hardhat lists its tasks. - [Set up an AWS KMS key](https://aelmanaa.github.io/hardhat-kms/user/guides/aws-kms-setup.md): Create an AWS KMS secp256k1 key for Ethereum signing, allow signing and nothing else, configure @hardhat-kms/aws and read the key's CloudTrail history. - [Set up an Azure Key Vault key](https://aelmanaa.github.io/hardhat-kms/user/guides/azure-key-vault-setup.md): Azure Key Vault and Managed HSM setup for Ethereum signing: a P-256K key, get and sign rights only, sign-in, config and audit logs. - [Set up a Google Cloud KMS key](https://aelmanaa.github.io/hardhat-kms/user/guides/gcp-kms-setup.md): Create a Google Cloud KMS secp256k1 HSM key for Ethereum signing, grant the IAM roles, configure @hardhat-kms/gcp and turn on audit logs. - [Prevent and recover from losing a key](https://aelmanaa.github.io/hardhat-kms/user/guides/key-loss.md): Undo a deleted AWS KMS, Cloud KMS or Key Vault key, guard keys against deletion and lockout, and retire a key without stranding its funds. - [Rotate a key and pin its address](https://aelmanaa.github.io/hardhat-kms/user/guides/key-rotation.md): What rotating an AWS KMS, Cloud KMS or Key Vault key does to your Ethereum address, how an address pin catches it, and how to move to a new key. - [Use several keys across networks](https://aelmanaa.github.io/hardhat-kms/user/guides/multiple-keys.md): Use several KMS keys across networks and clouds, next to local or Ledger accounts, and choose which address sends each transaction. - [Sign from GitHub Actions with OIDC](https://aelmanaa.github.io/hardhat-kms/user/guides/github-actions-oidc.md): Let a GitHub Actions job sign with an AWS KMS, Google Cloud KMS or Azure Key Vault key over OIDC, with no cloud credential stored in GitHub. - [Debug output](https://aelmanaa.github.io/hardhat-kms/user/guides/debug-output.md): Turn on hardhat-kms debug output with DEBUG=hardhat:kms:*, what each namespace logs, and what to check before you share it in an issue. - [Deploy with Hardhat Ignition](https://aelmanaa.github.io/hardhat-kms/user/guides/deploy-with-ignition.md): Hardhat Ignition with a KMS signer: choose the deployer, rehearse on a simulated network, deploy, resume after a KMS failure, and verify the source. - [Recover from an uncertain transaction send](https://aelmanaa.github.io/hardhat-kms/user/guides/uncertain-sends.md): After a KMS send with no clear answer, or one that is not mined: look it up, compare the pending and latest counts, then wait or fill a nonce. - [Return the funds from a KMS address](https://aelmanaa.github.io/hardhat-kms/user/guides/return-funds.md): A Hardhat script that sends a KMS account's Sepolia balance back to your wallet before you delete the key, with what it refuses and how it stops. - [Find who signed with a key](https://aelmanaa.github.io/hardhat-kms/user/guides/who-signed.md): hardhat kms history: who signed, from CloudTrail, Cloud Audit Logs or Azure Monitor - [Move KMS signing from Foundry to Hardhat](https://aelmanaa.github.io/hardhat-kms/user/guides/migrate-from-foundry.md): Foundry --aws and --gcp equivalents in Hardhat 3: the --kms option reads the same key variables, or the keys move into the config. - [Use a KMS key with Alchemy Wallet APIs](https://aelmanaa.github.io/hardhat-kms/user/guides/alchemy-wallet-apis.md): Make a KMS key the signer of an Alchemy smart wallet: what the key signs, what Alchemy does, a script that checks the signatures, and a sponsored send. - [Verify a release](https://aelmanaa.github.io/hardhat-kms/user/guides/verify-a-release.md): Check that the hardhat-kms packages you installed were built from a signed tag of this repository, with npm audit signatures, provenance and the tarball files. ### Reference - [Errors](https://aelmanaa.github.io/hardhat-kms/user/reference/errors.md): Every error hardhat-kms and its provider packages can raise, with its stable id, what it means and how to fix it, searchable by message. - [Library accounts reference](https://aelmanaa.github.io/hardhat-kms/user/reference/library-accounts.md): connection.kms.getAccount returns a viem account for a KMS key, for signAuthorization, smart accounts and scripts, with its options and what it refuses. - [Configuration reference](https://aelmanaa.github.io/hardhat-kms/user/reference/configuration.md): Every hardhat-kms config field: kms.keys, kms.defaults, kms.audit and kmsAccounts, the key forms per provider, validation and precedence. - [Credentials reference](https://aelmanaa.github.io/hardhat-kms/user/reference/credentials.md): Where hardhat-kms gets cloud credentials: the sources AWS, Google Cloud and Azure try, in order, with every variable they read. - [RPC methods reference](https://aelmanaa.github.io/hardhat-kms/user/reference/rpc-methods.md): Which JSON-RPC methods hardhat-kms answers for KMS accounts, which it passes to the node, and which transaction types it signs. - [Hardhat KMS tasks reference](https://aelmanaa.github.io/hardhat-kms/user/reference/tasks.md): Every kms task: list keys, sign messages, typed data, transactions and authorizations, verify signatures, and read a key's sign events. - [Errors](https://aelmanaa.github.io/hardhat-kms/user/reference/errors.md): Every error hardhat-kms and its provider packages can raise, with its stable id, what it means and how to fix it, searchable by message. - [Library accounts reference](https://aelmanaa.github.io/hardhat-kms/user/reference/library-accounts.md): connection.kms.getAccount returns a viem account for a KMS key, for signAuthorization, smart accounts and scripts, with its options and what it refuses. - [Supported Node.js versions](https://aelmanaa.github.io/hardhat-kms/user/reference/support.md): Which Node.js versions the hardhat-kms packages run on, when a release drops an end-of-life line, where to ask a question and how to report a test run. - [API reference](https://aelmanaa.github.io/hardhat-kms/user/reference/api.md): The TypeScript API of hardhat-kms: the plugin export, the config types, the helpers for provider plugins and the Alchemy prepared-call check. - [hardhat-kms](https://aelmanaa.github.io/hardhat-kms/user/reference/api/hardhat-kms.md): The hardhat-kms entry point: the plugin as its default export, which adds the kms config section and each network's kmsAccounts. - [hardhat-kms/alchemy](https://aelmanaa.github.io/hardhat-kms/user/reference/api/hardhat-kms/alchemy.md): The hardhat-kms/alchemy entry point: checkPreparedCalls, which checks an Alchemy Wallet APIs prepared call before a KMS key signs it. - [hardhat-kms/provider-utils](https://aelmanaa.github.io/hardhat-kms/user/reference/api/hardhat-kms/provider-utils.md): Helpers for writing a KMS provider plugin for hardhat-kms, the same ones the AWS, Google Cloud and Azure packages use; experimental. - [hardhat-kms/types](https://aelmanaa.github.io/hardhat-kms/user/reference/api/hardhat-kms/types.md): Public types of hardhat-kms/types: the kms config section, each provider's key config and the resolved forms Hardhat passes to plugins. ### Explanation - [Security model](https://aelmanaa.github.io/hardhat-kms/user/explanation/security-model.md): What hardhat-kms guarantees when a cloud KMS key signs, what it leaves to your cloud's access control, and what happens when a KMS call times out. - [A KMS key or a private key in .env](https://aelmanaa.github.io/hardhat-kms/user/explanation/kms-or-env-key.md): Should a Hardhat deployer key be a private key in .env or a cloud KMS key? What each protects against, what neither does, and what a KMS signature costs. - [A KMS key or a Ledger](https://aelmanaa.github.io/hardhat-kms/user/explanation/kms-or-ledger.md): hardhat-ledger or a KMS key in Hardhat 3: unattended signing in CI and scripts versus a prompt on a hardware wallet, and how to use both in one project. - [Compared with other KMS signers](https://aelmanaa.github.io/hardhat-kms/user/explanation/other-kms-signers.md): hardhat-kms compared with the Hardhat 2 hardhat-kms-signer packages and their forks: last release, Hardhat major, cloud, and how each plugs in. - [Comparison with Foundry](https://aelmanaa.github.io/hardhat-kms/user/explanation/foundry-comparison.md): hardhat-kms compared with Foundry's AWS and Google Cloud KMS signers: the checks it adds, and how each tool finds cloud credentials. - [Compared with other KMS signers](https://aelmanaa.github.io/hardhat-kms/user/explanation/other-kms-signers.md): hardhat-kms compared with the Hardhat 2 hardhat-kms-signer packages and their forks: last release, Hardhat major, cloud, and how each plugs in. - [A KMS key or a private key in .env](https://aelmanaa.github.io/hardhat-kms/user/explanation/kms-or-env-key.md): Should a Hardhat deployer key be a private key in .env or a cloud KMS key? What each protects against, what neither does, and what a KMS signature costs. - [A KMS key or a Ledger](https://aelmanaa.github.io/hardhat-kms/user/explanation/kms-or-ledger.md): hardhat-ledger or a KMS key in Hardhat 3: unattended signing in CI and scripts versus a prompt on a hardware wallet, and how to use both in one project. - [How hardhat-kms works](https://aelmanaa.github.io/hardhat-kms/user/explanation/how-it-works.md): How hardhat-kms signs at Hardhat's JSON-RPC layer: one transaction from viem or ethers through the network hook, the KMS and the node. - [Cloud credentials for KMS signing](https://aelmanaa.github.io/hardhat-kms/user/explanation/cloud-access.md): Which identity signs when Hardhat uses a KMS key on a laptop, in CI with OIDC or on a server, and how each cloud's credential chain picks it. - [Security model](https://aelmanaa.github.io/hardhat-kms/user/explanation/security-model.md): What hardhat-kms guarantees when a cloud KMS key signs, what it leaves to your cloud's access control, and what happens when a KMS call times out. - [Release channels and versioning](https://aelmanaa.github.io/hardhat-kms/user/explanation/versioning.md): What a hardhat-kms version promises: the latest and beta npm tags, the public API under semver, supported Hardhat, Node.js and viem, and security fixes. ### Other - [Live proof](https://aelmanaa.github.io/hardhat-kms/live-proof.md)