MONGOC_CLIENT..._KMS_PROVIDERS(3)

💅 MONGOC_CLIENT_ENCRYPTION_OPTS_SET_KMS_PROVIDERS(3)

okay so real talk — this one is from libmongoc, and it's genuinely one of those functions where the whole personality is in the BSON doc you hand it. Let's get into it bestie 🫶

---

✨ SYNOPSIS ✨

void
mongoc_client_encryption_opts_set_kms_providers (
   mongoc_client_encryption_opts_t *opts, const bson_t *kms_providers);

that's it. that's the whole call. void return, no drama, no error to check (she's built different) ✨

---

🎀 PARAMETERS 🎀

• opts — the mongoc_client_encryption_opts_t. your options struct, your main character 💅
• kms_providers — a bson_t containing configuration for an external Key Management Service (KMS). this is where you spill all your credential tea 🍓

kms_providers is a BSON document containing configuration for each KMS provider.

---

🌸 THE KMS PROVIDER VIBE CHECK 🌸

KMS providers are specified as a string of the form <KMS provider type> or <KMS provider type>:<KMS provider name>. The supported KMS provider types are aws, azure, gcp, local, and kmip. The optional name enables configuring multiple KMS providers with the same KMS provider type (e.g. aws:name1 and aws:name2 can refer to different AWS accounts). At least one KMS provider must be specified. no cap, one minimum, that's the rule 👑

---

☁️ aws — the cloud girlie

Supported forms of the KMS provider type aws include:

aws: {
   accessKeyId: String,
   secretAccessKey: String
}

// To pass temporary credentials:
aws: {
   accessKeyId: String,
   secretAccessKey: String
   sessionToken: String
}

// To request credentials from the environment:
aws: {}

lowkey love the empty {} form — she just asks the environment for credentials, iykyk 🌈

---

🔐 local — the DIY queen

Supported forms of the KMS provider type local include:

local: {
   // key is used to encrypt/decrypt data keys:
   key: "<96 byte BSON binary of subtype 0>" or String // May be passed as a base64 encoded string.
}

⚠️ note that key is literally <96 byte BSON binary of subtype 0> — or a String, because it May be passed as a base64 encoded string. count those bytes bestie, 96, not 95, not 97 💀

---

💜 azure — microsoft baddie

Supported forms of the KMS provider type azure include:

azure: {
   tenantId: String,
   clientId: String,
   clientSecret: String,
   identityPlatformEndpoint: Optional<String> // Defaults to login.microsoftonline.com
}

// To pass an accessToken directly:
azure: {
   accessToken: String
}

// To request credentials from the environment:
azure: {}

identityPlatformEndpoint is Optional and Defaults to login.microsoftonline.com — she has a default, she's low maintenance ✨

---

🦋 gcp — google fairy

Supported forms of the KMS provider type gcp include:

gcp: {
   email: String,
   privateKey: byte[] or String, // May be passed as a base64 encoded string.
   endpoint: Optional<String> // Defaults to oauth2.googleapis.com
}

// To pass an accessToken directly:
gcp: {
   accessToken: String
}

// To request credentials from the environment:
gcp: {}

privateKey is byte[] or String, and again — May be passed as a base64 encoded string. endpoint is Optional and Defaults to oauth2.googleapis.com. defaults girlies stay winning 🎀

---

🔥 kmip — the minimal icon

Supported forms of the KMS provider type kmip include:

kmip: {
   endpoint: String
}

that's it. one field. she said "endpoint" and left. iconic behavior honestly 👑

---

🧚 NAMED PROVIDERS — because one of each is not enough

KMS providers may include an optional name suffix separate with a colon. This enables configuring multiple KMS providers with the same KMS provider type. Example:

"aws:name1": {
   accessKeyId: String,
   secretAccessKey: String
},
"aws:name2": {
   accessKeyId: String,
   secretAccessKey: String
}

two AWS accounts, one BSON doc, zero problems 💖 the colon is doing so much work here fr fr.

---

👀 SEE ALSO

• mongoc_client_encryption_new()
• In-Use Encryption

go read those next, bestie, they're the sequel 🫶

---

💜 AUTHOR

MongoDB, Inc

🎀 COPYRIGHT

2009-present, MongoDB, Inc.

---

okay that's the whole page!! go forth and configure your KMS providers responsibly 🌸✨

— with love from libmongoc, version 2.5.6, dated Oct 09, 2026 🦋💅 periodt.