Using gRPC with Cloud KMS

If you are using manually created gRPC libraries to make calls to Cloud Key Management Service, you must specify a x-google-request-params value in the metadata, or header, of the call. The proper use of x-google-request-params will route the call to the appropriate region for your Cloud KMS resources.

Set the x-google-request-params value to a field in the method's request as shown in the following table.

Method Request field
AsymmetricDecrypt AsymmetricDecryptRequest.name
AsymmetricSign AsymmetricSignRequest.name
CreateCryptoKey CreateCryptoKeyRequest.parent
CreateCryptoKeyVersion CreateCryptoKeyVersionRequest.parent
CreateImportJob CreateImportJobRequest.parent
CreateKeyRing CreateKeyRingRequest.parent
Decrypt DecryptRequest.name
DestroyCryptoKeyVersion DestroyCryptoKeyVersionRequest.name
Encrypt EncryptRequest.name
GenerateRandomBytes GenerateRandomBytesRequest.name
GetCryptoKey GetCryptoKeyRequest.name
GetCryptoKeyVersion GetCryptoKeyVersionRequest.name
GetImportJob GetImportJobRequest.name
GetKeyRing GetKeyRingRequest.name
GetPublicKey GetPublicKeyRequest.name
ImportCryptoKeyVersion ImportCryptoKeyVersionRequest.name
ListCryptoKeyVersions ListCryptoKeyVersionsRequest.parent
ListCryptoKeys ListCryptoKeysRequest.parent
ListImportJobs ListImportJobsRequest.parent
ListKeyRings ListKeyRingsRequest.parent
MacSign MacSignRequest.name
MacVerify MacVerifyRequest.name
RawDecrypt RawDecryptRequest.name
RawEncrypt RawEncryptRequest.name
RestoreCryptoKeyVersion RestoreCryptoKeyVersionRequest.name
UpdateCryptoKey UpdateCryptoKeyRequest.crypto_key.name
UpdateCryptoKeyPrimaryVersion UpdateCryptoKeyPrimaryVersionRequest.name
UpdateCryptoKeyVersion UpdateCryptoKeyVersionRequest.crypto_key_version.name

Setting the request field

The following examples show where to specify the resource name in various methods. Replace the text styled as place-holder with the actual values used in your Cloud KMS resource IDs.

Decrypt example

If you are making a call to Decrypt, you need to populate the following fields in your request:

name: 'projects/project-id/locations/location/keyRings/key-ring/cryptoKeys/key-name/'
ciphertext: 'iQALWM/r6alAxQm0VQe3...'

The value assigned to the name field is the resource name of your CryptoKey. To properly route the call, you must also include this resource name in the call metadata, in the following form: