External KMS (Enterprise)
Offload JWT signing and data-encryption keys to AWS KMS or GCP Cloud KMS — private key material never leaves the KMS.
- By default, Tobogganing uses an in-app key provider suitable for Community deployments.
- Enterprise deployments can offload RS256 JWT signing and AES-256 data encryption to AWS KMS or GCP Cloud KMS.
- Only signatures and unwrapped data-encryption keys are returned by the KMS — private key material never leaves it.
- JWT verification happens locally against a cached public key, with zero KMS calls per request.