Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels) Summary: [Constants](https://developer.android.com/reference/android/security/keystore/KeyStoreManager#constants) \| [Methods](https://developer.android.com/reference/android/security/keystore/KeyStoreManager#pubmethods) \| [Inherited Methods](https://developer.android.com/reference/android/security/keystore/KeyStoreManager#inhmethods)

# KeyStoreManager

*** ** * ** ***

` public final class KeyStoreManager `   
` extends https://developer.android.com/reference/java/lang/Object ` ` `

|---|---|
| [java.lang.Object](https://developer.android.com/reference/java/lang/Object) ||
| ↳ | android.security.keystore.KeyStoreManager |

<br />

*** ** * ** ***

This class provides methods for interacting with keys stored within the [Android Keystore](https://developer.android.com/privacy-and-security/keystore).

## Summary

| ### Constants ||
|---|---|
| `int` | `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#MODULE_HASH` When passed into getSupplementaryAttestationInfo, getSupplementaryAttestationInfo returns the DER-encoded structure corresponding to the \`Modules\` schema described in the KeyMint HAL's KeyCreationResult.aidl. |

| ### Public methods ||
|---|---|
| ` https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getGrantedCertificateChainFromId(long)(long id) ` Returns a `https://developer.android.com/reference/java/util/List` of `https://developer.android.com/reference/java/security/cert/X509Certificate` instances representing the certificate chain for the key that was previously shared with the app under the provided `id`. |
| ` https://developer.android.com/reference/java/security/Key` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getGrantedKeyFromId(long)(long id) ` Returns the key with the specified `id` that was previously shared with the app. |
| ` https://developer.android.com/reference/java/security/KeyPair` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getGrantedKeyPairFromId(long)(long id) ` Returns a `https://developer.android.com/reference/java/security/KeyPair` containing the public and private key associated with the key that was previously shared with the app under the provided `id`. |
| ` byte[]` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getSupplementaryAttestationInfo(int)(int tag) ` Returns tag-specific data required to interpret a tag's attested value. |
| ` long` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#grantKeyAccess(java.lang.String,%20int)(https://developer.android.com/reference/java/lang/String alias, int uid) ` Grants access to the key owned by the calling app stored under the specified `alias` to another app on the device with the provided `uid`. |
| ` void` | ` https://developer.android.com/reference/android/security/keystore/KeyStoreManager#revokeKeyAccess(java.lang.String,%20int)(https://developer.android.com/reference/java/lang/String alias, int uid) ` Revokes access to the key in the app's namespace stored under the specified `alias` that was previously granted to another app on the device with the provided `uid`. |

### Inherited methods

From class ` https://developer.android.com/reference/java/lang/Object ` ` https://developer.android.com/reference/java/lang/Object` ` https://developer.android.com/reference/java/lang/Object#clone()() `

Creates and returns a copy of this object.
` boolean` ` https://developer.android.com/reference/java/lang/Object#equals(java.lang.Object)(https://developer.android.com/reference/java/lang/Object obj) `

Indicates whether some other object is "equal to" this one.
` void` ` https://developer.android.com/reference/java/lang/Object#finalize()() `

Called by the garbage collector on an object when garbage collection determines that there are no more references to the object.
` final https://developer.android.com/reference/java/lang/Class<?>` ` https://developer.android.com/reference/java/lang/Object#getClass()() `

Returns the runtime class of this `Object`.
` int` ` https://developer.android.com/reference/java/lang/Object#hashCode()() `

Returns a hash code value for the object.
` final void` ` https://developer.android.com/reference/java/lang/Object#notify()() `

Wakes up a single thread that is waiting on this object's monitor.
` final void` ` https://developer.android.com/reference/java/lang/Object#notifyAll()() `

Wakes up all threads that are waiting on this object's monitor.
` https://developer.android.com/reference/java/lang/String` ` https://developer.android.com/reference/java/lang/Object#toString()() `

Returns a string representation of the object.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long,%20int)(long timeoutMillis, int nanos) `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait(long)(long timeoutMillis) `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*, or until a certain amount of real time has elapsed.
` final void` ` https://developer.android.com/reference/java/lang/Object#wait()() `

Causes the current thread to wait until it is awakened, typically by being *notified* or *interrupted*.

## Constants

### MODULE_HASH

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public static final int MODULE_HASH
```

When passed into getSupplementaryAttestationInfo, getSupplementaryAttestationInfo returns the DER-encoded structure corresponding to the \`Modules\` schema described in the KeyMint HAL's KeyCreationResult.aidl. The SHA-256 hash of this encoded structure is what's included with the tag in attestations. To ensure the returned encoded structure is the one attested to, clients should verify its SHA-256 hash matches the one in the attestation. Note that the returned structure can vary between boots.

<br />

Constant Value: -1879047468 (0x900002d4)

## Public methods

### getGrantedCertificateChainFromId

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public List<X509Certificate> getGrantedCertificateChainFromId (long id)
```

Returns a `https://developer.android.com/reference/java/util/List` of `https://developer.android.com/reference/java/security/cert/X509Certificate` instances representing the certificate chain for the key that was previously shared with the app under the provided `id`.

If a `https://developer.android.com/reference/java/security/PrivateKey` has not been granted to the caller with the specified `id`, then an `https://developer.android.com/reference/java/security/UnrecoverableKeyException` is thrown.

<br />

| Parameters ||
|---|---|
| `id` | `long`: the ID of the asymmetric key that was shared with the app <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/util/List<https://developer.android.com/reference/java/security/cert/X509Certificate>` | a List of X509Certificates with the certificate at index 0 corresponding to the private key shared with the app. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/keystore/KeyPermanentlyInvalidatedException` | if the specified key was authorized to only be used if the user has been authenticated and a change has been made to the users lockscreen or biometric enrollment that permanently invalidates the key |
| `https://developer.android.com/reference/java/security/UnrecoverableKeyException` | if the specified key cannot be recovered |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#grantKeyAccess(java.lang.String,%20int)`

### getGrantedKeyFromId

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public Key getGrantedKeyFromId (long id)
```

Returns the key with the specified `id` that was previously shared with the app.

This method can return instances of both `https://developer.android.com/reference/javax/crypto/SecretKey` and `https://developer.android.com/reference/java/security/PrivateKey`. If a key with the provide `id` has not been granted to the caller, then an `https://developer.android.com/reference/java/security/UnrecoverableKeyException` is thrown.

<br />

| Parameters ||
|---|---|
| `id` | `long`: the ID of the key that was shared with the app <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/security/Key` | the `https://developer.android.com/reference/java/security/Key` that was shared with the app. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/keystore/KeyPermanentlyInvalidatedException` | if the specified key was authorized to only be used if the user has been authenticated and a change has been made to the users lockscreen or biometric enrollment that permanently invalidates the key |
| `https://developer.android.com/reference/java/security/UnrecoverableKeyException` | if the specified key cannot be recovered |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#grantKeyAccess(java.lang.String,%20int)`

### getGrantedKeyPairFromId

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public KeyPair getGrantedKeyPairFromId (long id)
```

Returns a `https://developer.android.com/reference/java/security/KeyPair` containing the public and private key associated with the key that was previously shared with the app under the provided `id`.

If a `https://developer.android.com/reference/java/security/PrivateKey` has not been granted to the caller with the specified `id`, then an `https://developer.android.com/reference/java/security/UnrecoverableKeyException` is thrown.

<br />

| Parameters ||
|---|---|
| `id` | `long`: the ID of the private key that was shared with the app <br /> |

| Returns ||
|---|---|
| `https://developer.android.com/reference/java/security/KeyPair` | a KeyPair containing the public and private key shared with the app. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/keystore/KeyPermanentlyInvalidatedException` | if the specified key was authorized to only be used if the user has been authenticated and a change has been made to the users lockscreen or biometric enrollment that permanently invalidates the key |
| `https://developer.android.com/reference/java/security/UnrecoverableKeyException` | if the specified key cannot be recovered |

### getSupplementaryAttestationInfo

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public byte[] getSupplementaryAttestationInfo (int tag)
```

Returns tag-specific data required to interpret a tag's attested value. When performing key attestation, the obtained attestation certificate contains a list of tags and their corresponding attested values. For some tags, additional information about the attested value can be queried via this API. See individual tags for specifics.

<br />

| Parameters ||
|---|---|
| `tag` | `int`: tag for which info is being requested. Value is one of the following: - `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#MODULE_HASH` |

| Returns ||
|---|---|
| `byte[]` | tag-specific info. This value cannot be `null`. <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/KeyStoreException` | if the requested info is not available |

### grantKeyAccess

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public long grantKeyAccess (String alias, 
                int uid)
```

Grants access to the key owned by the calling app stored under the specified `alias` to another app on the device with the provided `uid`.

This method supports granting access to instances of both `https://developer.android.com/reference/javax/crypto/SecretKey` and `https://developer.android.com/reference/java/security/PrivateKey`. The resulting ID will persist across reboots and can be used by the grantee app for the life of the key or until access is revoked with `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#revokeKeyAccess(java.lang.String,%20int)`.

If the provided `alias` does not correspond to a key in the Android KeyStore, then an `https://developer.android.com/reference/java/security/UnrecoverableKeyException` is thrown.

<br />

| Parameters ||
|---|---|
| `alias` | `String`: the alias of the key to be granted to another app. This value cannot be `null`. <br /> |
| `uid` | `int`: the uid of the app to which the key should be granted <br /> |

| Returns ||
|---|---|
| `long` | the ID of the granted key; this can be shared with the specified app, and that app can use `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getGrantedKeyFromId(long)` to access the key <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/KeyStoreException` | if an error is encountered when attempting to grant access to the key |
| `https://developer.android.com/reference/java/security/UnrecoverableKeyException` | if the specified key cannot be recovered |

**See also:**

- `https://developer.android.com/reference/android/security/keystore/KeyStoreManager#getGrantedKeyFromId(long)`

### revokeKeyAccess

Added in [API level 36](https://developer.android.com/guide/topics/manifest/uses-sdk-element#ApiLevels)

```
public void revokeKeyAccess (String alias, 
                int uid)
```

Revokes access to the key in the app's namespace stored under the specified `alias` that was previously granted to another app on the device with the provided `uid`.

If the provided `alias` does not correspond to a key in the Android KeyStore, then an `https://developer.android.com/reference/java/security/UnrecoverableKeyException` is thrown.

<br />

| Parameters ||
|---|---|
| `alias` | `String`: the alias of the key to be revoked from another app. This value cannot be `null`. <br /> |
| `uid` | `int`: the uid of the app from which the key access should be revoked <br /> |

| Throws ||
|---|---|
| `https://developer.android.com/reference/android/security/KeyStoreException` | if an error is encountered when attempting to revoke access to the key |
| `https://developer.android.com/reference/java/security/UnrecoverableKeyException` | if the specified key cannot be recovered |