Skip to content

GCP KMS setup

Planned, not yet shipped

The current signer (KmsSigner) uses AWS KMS. A Google Cloud KMS signer is planned, but it isn't available in the SDK yet, so there's no validated runbook to publish here — and we don't ship untested custody instructions.

If you're on Google Cloud today, you have two working options:

  • Run signing against AWS KMS from your GCP workload — the KmsSigner only needs AWS credentials and network access, not AWS compute. See AWS KMS setup.
  • Use a raw key for dev/sandbox only (PRIMEDELTA_MCP_PRIVATE_KEY), never for real funds. See Signing modes.

This page will be replaced with a full runbook once GCP KMS signing is validated end-to-end against the signer. If GCP KMS is a hard requirement for you, let the team know so it can be prioritized.