Azure Key Vault Emulator

Local emulator of the Azure Key Vault data plane in a single Go binary — secrets, keys (real RSA/EC cryptography), and certificates (self-signed + PFX/PEM import), with versioning and soft delete on a controllable clock. Unlike pass-through emulators, authentication is the point: the 401 challenge advertises a real Entra authority and every token is validated for signature, issuer, vault audience, and expiry against entra-emulator’s JWKS — so DefaultAzureCredential walks the same path it walks in production, and the real azsecrets / azkeys / azcertificates SDKs authenticate against it exactly as against Azure.

Caution

Local development tool only — intentionally insecure (self-signed TLS, no real authorization boundary by default). It emulates the data-plane contract, not a security boundary. Run it on localhost only.

Start here

• Quickstart — compose up the pair, mint a token, read and write a secret
• Installation — brew, winget, go install, Docker, compose
• Architecture — the challenge-auth trust model and why it matters
• Secrets · Keys · Certificates — the data-plane reference
• Authentication — the challenge handshake, credential paths, the permission map
• Testing — freeze the clock, inject throttling; the three-emulator chain
• Roadmap — phases P0–P3 and what’s next