MONGOC_CLIENT..._SET_MASTERKEY(3)

💅 MONGOC_CLIENT..._SET_MASTERKEY(3) 💅

okay bestie, buckle up — this one's from the libmongoc manual, and it's all about telling your encryption setup which master key to use. it's giving "key management but make it cute" 🔑

---

✨ SYNOPSIS ✨

void
mongoc_client_encryption_datakey_opts_set_masterkey (
   mongoc_client_encryption_datakey_opts_t *opts, const bson_t *masterkey);

so like, what does it even do? it identifies the masterkey for the Key Management Service (KMS) provider that's gonna encrypt a brand new data key. that's the whole vibe. 🫶

---

🎀 PARAMETERS 🎀

• opts — a mongoc_client_encryption_datakey_opts_t. yes, that whole mouthful. it's the options struct you're poking at 💅
• masterkey — a bson_t document describing the masterkey, and it's specific to whatever KMS provider you're rolling with.

---

🦋 DESCRIPTION 🦋

okay so here's the tea ☕ — setting the masterkey is required when you're creating a data key with these KMS provider types: aws, azure, gcp, and kmip. no masterkey, no data key, no cap.

but!! setting the masterkey is prohibited with the KMS provider type local. so don't even try it, bestie 🙈

🌈 the aws format 🌈

the format of masterkey for the KMS provider type aws is literally this:

{
   region: String,
   key: String, /* The Amazon Resource Name (ARN) to the AWS customer master key (CMK). */
   endpoint: Optional<String> /* An alternate host identifier to send KMS requests to. May include port number. Defaults to "kms.<region>.amazonaws.com" */
}

🌸 the azure format 🌸

the format of masterkey for the KMS provider type azure is as follows:

{
   keyVaultEndpoint: String, /* Host with optional port. Example: "example.vault.azure.net". */
   keyName: String,
   keyVersion: Optional<String> /* A specific version of the named key, defaults to using the key's primary version. */
}

⭐ the gcp format ⭐

the format of masterkey for the KMS provider type gcp is as follows:

{
   projectId: String,
   location: String,
   keyRing: String,
   keyName: String,
   keyVersion: Optional<String>, /* A specific version of the named key, defaults to using the key's primary version. */
   endpoint: Optional<String> /* Host with optional port. Defaults to "cloudkms.googleapis.com". */
}

🧚 the kmip format 🧚

the format of masterkey for the KMS provider type kmip is as follows:

{
   keyId: Optional<String>,
   delegated: Optional<Boolean>, /* If true (recommended), the KMIP server must decrypt this key. Defaults to false. */
   endpoint: Optional<String> /* Host with optional port. */
}

💡 quick vibe check: those Optional<...> fields are optional, and the defaults are written right there in the comments — don't come for me, it's all in the original, iykyk.

---

👑 AUTHOR 👑

MongoDB, Inc — icons only 💜

---

🔥 COPYRIGHT 🔥

2009-present, MongoDB, Inc.

---

and that's the whole page, bestie 🎀 she's iconic, she's thorough, and she ate. this was libmongoc 2.5.6, dated Oct 09, 2026 — mwah 💋 slay, go set some masterkeys ✨