LocalCloud Cloud KMS Local Emulator
Get started
local.cloud — Cloud KMS Local Emulator .md Open tab
LocalCloud Google Cloud in-a-box

Cloud KMS

Cloud KMS manages cryptographic keys and their versions. Applications use keys to encrypt data, sign messages, or verify authenticity without storing key material in application code.

When to use Cloud KMS

Typical uses

Use when applications encrypt, decrypt, sign, or verify data using managed keys and explicit key versions. Keep cryptographic key lifecycle separate from application payloads.

Examples

  • Encryption and decryption
  • Signing, MACs, and key lifecycle tests
Security

Explore another service

View all
Local workflow

Example usage

Install the CLI, start LocalCloud, and export its environment in the same shell. Generated endpoints account for remapped ports.

1. Install and start · shell
curl -fsSL https://local.cloud/install.sh | sh
localcloud start --local-only
# Export GOOGLE_CLOUD_PROJECT and CLOUD_KMS_EMULATOR_HOST
eval "$(localcloud env)"

Encrypt and decrypt with a software key

  1. Create a key ring and an eligible software crypto key.
  2. Encrypt a small payload through the KMS API.
  3. Decrypt it and assert the original bytes are restored.

Documented workflows

  • Locations, random bytes, keys/versions, rotation, destruction/restoration, and eligible deletion
  • SOFTWARE symmetric/asymmetric cryptography, public keys, and MACs
  • Supported post-quantum signing/decapsulation and wrapped key imports
  • Strict IAM, conditions, audits, metrics, and authenticated Workflows connectors
  • Secret Manager CMEK, project Inventory, and Autokey/KeyHandles

Service boundaries

  • SOFTWARE keys; hardware custody and Google authority are cloud-only
  • Inventory/Autokey: project-owned global Secret Manager resources only
  • No folder ancestry or other protected-resource types
  • KeyRing deletion isn't guaranteed to match Google Cloud
Try it in your project

Code examples and integrations

Start with the local guides. Official Google Cloud samples may need endpoint changes and can cover features outside the workflows listed here.

Integration

Build an integration test loop

Start the runtime, verify readiness, exercise your SDK, and clean up test state.

Open guide
Google Cloud

Official SDK code samples

Browse language-specific samples. Adapt endpoints and use the local workflows listed above.

Browse official samples
Agent testing

Use Cloud KMS with an AI agent

Before the agent changes application logic, have it create local Cloud KMS state, read it back with the project SDK, and note which feature the check covered. That first local call catches accidental production routing and needs no GCP account, service-account key, or billing project.

Configure this repo

Set up this repository to use LocalCloud for local GCP development. First read https://local.cloud/ai/agents.md, then inspect this repo, identify the GCP services and SDK language, configure emulator environment variables, and run the narrowest integration test against localhost. Do not use real GCP credentials or production endpoints.

Production endpoints, auth, IAM, quotas, regional behavior, and final release validation still need the target Google Cloud project.

Agent resources has more prompts and the AGENTS.md template.

Related guides

Desktop view