--- schema_version: "1" id: d5187a75cc575c5f23422a689699412ecfc84c93254e3aebdfa4340ca83a350a title: Create an Encryption Key for Marketing Cloud Engagement collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_create_a_key.md canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_create_a_key.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 0261d787c88346b5977213f512852756807e4625b521312b6c8517e3bccae1dc description: Create an encryption key for Marketing Cloud Engagement activities. products: - Marketing - Marketing Cloud Engagement release: "264" --- # Create an Encryption Key for Marketing Cloud Engagement Create an encryption key for Marketing Cloud Engagement activities. 1. In Setup, under Data Management, select **Key Management**. 2. Click **Create**. 3. Choose the type of key to create. 4. For Name, enter a name for the key. 5. Leave the External Key field blank. After the first handshake, Marketing Cloud Engagement automatically populates this field with the key from the external provider. 6. Complete the appropriate fields for your encryption type.
Encryption Type Description
Asymmetric keys

Click Choose File. Select the .pub or .asc (PGP format) file for your key, and click OK.

  • Use public asymmetric keys for file transfer encryption from a safehouse location to another file location.
  • Use private asymmetric keys for file transfer decryption. Select private key and enter your passphrase if applicable.
Symmetric keys Enter the key passphrase.
Initialization vector (IV) keys In the IV field, enter the key value.
Salt keys In the Salt field, enter the key value.
SSH keys

Upload the key value to use.

  • For SSH keys used in SFTP authentication, select Public Key. Engagement uses the public key value for SFTP user authentication.
  • For file transfer activities, such as reports and imports, use the private key file.
SSO metadata information

Enter the applicable information.

  • Paste Metadata—Enter the SAML metadata obtained from your third-party identity partner.
  • Guided Configuration
    • Identity Provider Certificate—Click Browse and select the certificate.
    • Entity ID— Enter the entity ID.
    • Name ID Format—Select a format from the dropdown menu.
    • Single Logout Service Location— Enter the URL for the single logout service location.
    • Single Logout Service Binding—Select HTTP REDIRECT or HTTP POST.
Security context
    • Grant Type—Select Client Credentials or JWT Bearer.
    • Token Endpoint—Enter the URL of the external web service to call to retrieve an access token.
    • Key ID—Enter the Key ID to pass to the token endpoint as part of the JWT header.
    • Issuer—Enter the Issuer value to pass to the external web service in the JWT payload.
    • Audience—Enter the Audience value to pass to the external web service in the JWT payload.
    • Subject—Enter the Subject value to pass to the external web service in the payload.
    • Valid Service URLs—Enter the URLs that the returned access token applies to. Enter each URL on a new line.
    • Private Key (PEM Format)—Enter the value of the RSA private key to use to encrypt JWT payloads.
7. Click **Save**. After you create the SAML key, click the key to view the SAML SP metadata. The metadata gives you the appropriate URLs to use to enable SSO authentication. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-mktg-mc_marketing_cloud_overview-264-0-0-production-enus/2555afdb-8049-4e3c-8043-0e04803e5f16/images/icon_note.png) Note You manage keys separately in each business unit. To use the same key in more than one business unit, upload it separately to each one.