Skip to main content
KMS (Key Management Service) methods let you query the key management infrastructure used to encrypt CVM environment variables and manage on-chain app contracts. Most applications use the default "phala" KMS type, but the SDK supports querying any available KMS.

​
GetKMSList

GET /kms Returns a paginated list of all available KMS servers. 
func (c *Client) GetKMSList(ctx context.Context) (*GetKMSListResponse, error)
Returns: *GetKMSListResponse — a Paginated[KMSInfo] containing:
FieldTypeDescription
Items[]KMSInfoList of KMS servers
TotalintTotal count
PageintCurrent page
PageSizeintItems per page
PagesintTotal pages
Each KMSInfo contains:
FieldTypeDescription
IDstringKMS identifier
Slug*stringURL-friendly slug
URLstringKMS server URL
VersionstringKMS version
ChainID*intBlockchain chain ID (for on-chain KMS)
KMSContractAddress*stringOn-chain KMS contract address
kmsList, err := client.GetKMSList(ctx)
if err != nil {
	log.Fatal(err)
}
for _, kms := range kmsList.Items {
	fmt.Printf("KMS: %s (version: %s)\n", kms.ID, kms.Version)
}

​
GetKMSInfo

GET /kms/{kmsId} Returns detailed information about a specific KMS server. 
func (c *Client) GetKMSInfo(ctx context.Context, kmsID string) (*KMSInfo, error)
Parameters:
FieldTypeRequiredDescription
kmsIDstringYesKMS identifier
Returns: *KMSInfo 
kms, err := client.GetKMSInfo(ctx, "phala")
if err != nil {
	log.Fatal(err)
}
fmt.Printf("KMS URL: %s\n", kms.URL)

​
GetAppEnvEncryptPubKey

GET /kms/{kmsType}/pubkey/{appId} Returns the public key used to encrypt environment variables for a specific app. You need this key to encrypt env vars before passing them to UpdateCVMEnvs or CommitCVMProvision. 
func (c *Client) GetAppEnvEncryptPubKey(ctx context.Context, kmsType, appID string) (*AppEnvPubKeyResponse, error)
Parameters:
FieldTypeRequiredDescription
kmsTypestringYesKMS type (e.g., "phala")
appIDstringYesApplication identifier
Returns: *AppEnvPubKeyResponse (generic map containing the public key) 
pubkey, err := client.GetAppEnvEncryptPubKey(ctx, "phala", "app-abc123")
if err != nil {
	log.Fatal(err)
}
The encryption public key is specific to each app and KMS combination. Always fetch a fresh key before encrypting environment variables.

​
GetKMSOnChainDetail

GET /kms/on-chain/{chain} Returns on-chain details for a KMS on a specific blockchain, including contract addresses, registered devices, and OS images. 
func (c *Client) GetKMSOnChainDetail(ctx context.Context, chain string) (*KMSOnChainDetail, error)
Parameters:
FieldTypeRequiredDescription
chainstringYesChain name (e.g., "base")
Returns: *KMSOnChainDetail containing:
FieldTypeDescription
ChainNamestringBlockchain name
ChainIDintBlockchain chain ID
Contracts[]OnChainKMSContractList of KMS contracts with devices and OS images
detail, err := client.GetKMSOnChainDetail(ctx, "base")
if err != nil {
	log.Fatal(err)
}
fmt.Printf("Chain: %s (ID: %d), Contracts: %d\n", detail.ChainName, detail.ChainID, len(detail.Contracts))

​
NextAppIDs

GET /kms/phala/next_app_id Returns the next available app IDs for provisioning. Useful when you need to reserve an app ID before deployment. 
func (c *Client) NextAppIDs(ctx context.Context) (*NextAppIDsResponse, error)
Returns: *NextAppIDsResponse (generic map) 
nextIDs, err := client.NextAppIDs(ctx)
if err != nil {
	log.Fatal(err)
}