diff --git a/waltid-applications/waltid-web-wallet/apps/waltid-dev-wallet/src/pages/wallet/[wallet]/settings/keys/generate.vue b/waltid-applications/waltid-web-wallet/apps/waltid-dev-wallet/src/pages/wallet/[wallet]/settings/keys/generate.vue
index d22d038c6..faf16326b 100644
--- a/waltid-applications/waltid-web-wallet/apps/waltid-dev-wallet/src/pages/wallet/[wallet]/settings/keys/generate.vue
+++ b/waltid-applications/waltid-web-wallet/apps/waltid-dev-wallet/src/pages/wallet/[wallet]/settings/keys/generate.vue
@@ -108,8 +108,8 @@
 
 <script lang="ts" setup>
 import CenterMain from "@waltid-web-wallet/components/CenterMain.vue";
-import { ArrowUturnLeftIcon, CheckIcon, KeyIcon, } from "@heroicons/vue/24/outline";
-import { useCurrentWallet } from "@waltid-web-wallet/composables/accountWallet.ts";
+import {ArrowUturnLeftIcon, CheckIcon, KeyIcon,} from "@heroicons/vue/24/outline";
+import {useCurrentWallet} from "@waltid-web-wallet/composables/accountWallet.ts";
 import InlineLoadingCircle from "@waltid-web-wallet/components/loading/InlineLoadingCircle.vue";
 
 const loading = ref(false);
@@ -172,6 +172,15 @@ const options = ref([
     ],
     config: ["roleName", "region"]
   },
+  {
+    keyGenerationRequest: ["Azure with Client access key", "azure"],
+    keyType: [
+      ["ECDSA_Secp256r1", "secp256r1"],
+      ["ECDSA_Secp256k1", "secp256k1"],
+      ["RSA", "RSA"]
+    ],
+    config: ["clientId", "clientSecret", "tenantId", "keyVaultUrl"]
+  },
 ]);
 
 const data = reactive<{
@@ -188,55 +197,60 @@ const data = reactive<{
 const currentWallet = useCurrentWallet();
 
 async function generateKey() {
-  const body = {
-    backend: data.keyGenerationRequest.type.includes("aws") ? "aws" : data.keyGenerationRequest.type,
+  const keyGenerationRequest = data.keyGenerationRequest;
+  const type = keyGenerationRequest?.type;
+  const config = keyGenerationRequest?.config;
+
+  // Build the body based on the key generation type and config
+  const body: any = {
+    backend: type?.includes("aws") ? "aws" : type,
     keyType: data.type,
-    config: {
-      // If AWS, wrap config keys in an 'auth' object, otherwise leave them in the config
-      ...(data.keyGenerationRequest.type === "aws-access-key"
-          ? {
-            auth: {
-              accessKeyId: data.keyGenerationRequest.config.accessKeyId,
-              secretAccessKey: data.keyGenerationRequest.config.secretAccessKey,
-              region: data.keyGenerationRequest.config.region,
-
-            },
-          }
-          : data.keyGenerationRequest.type === "aws-role-name"
-              ? {
-                auth: {
-                  roleName: data.keyGenerationRequest.config.roleName,
-                  region: data.keyGenerationRequest.config.region,
-                },
-              }
-
-              : {
-                // If not AWS, keep keys in the config directly
-                ...data.keyGenerationRequest.config,
-              }),
-    },
+    config: {},
   };
+
+  // Configure the 'config' object depending on the type (AWS, Azure, etc.)
+  if (type === "aws-access-key") {
+    body.config.auth = {
+      accessKeyId: config?.accessKeyId,
+      secretAccessKey: config?.secretAccessKey,
+      region: config?.region,
+    };
+  } else if (type === "aws-role-name") {
+    body.config.auth = {
+      roleName: config?.roleName,
+      region: config?.region,
+    };
+  } else if (type === "azure") {
+    body.config.auth = {
+      clientId: config?.clientId,
+      clientSecret: config?.clientSecret,
+      tenantId: config?.tenantId,
+      keyVaultUrl: config?.keyVaultUrl,
+    };
+  } else {
+    // For other types, just include the config directly
+    body.config = {...config};
+  }
+
   loading.value = true;
 
   try {
-    response.value = await $fetch(
-        `/wallet-api/wallet/${currentWallet.value}/keys/generate`,
-        {
-          method: "POST",
-          body: JSON.stringify(body), // Ensure the body is a JSON string
-          headers: {
-            "Content-Type": "application/json",
-          },
-        }
-    );
+    response.value = await $fetch(`/wallet-api/wallet/${currentWallet.value}/keys/generate`, {
+      method: "POST",
+      body, // fetch automatically handles JSON conversion
+      headers: {
+        "Content-Type": "application/json",
+      },
+    });
   } catch (e: any) {
     console.error("Error generating key:", e);
-    alert("Failed to generate key: " + e.message);
+    alert("Failed to generate key: " + (e.message || e));
   } finally {
     loading.value = false;
   }
 }
 
+
 useHead({
   title: "Generate key - walt.id",
 });
diff --git a/waltid-libraries/auth/waltid-ktor-authnz/src/main/kotlin/id/walt/ktorauthnz/tokens/jwttoken/JwtTokenHandler.kt b/waltid-libraries/auth/waltid-ktor-authnz/src/main/kotlin/id/walt/ktorauthnz/tokens/jwttoken/JwtTokenHandler.kt
index e94755671..55fc37041 100644
--- a/waltid-libraries/auth/waltid-ktor-authnz/src/main/kotlin/id/walt/ktorauthnz/tokens/jwttoken/JwtTokenHandler.kt
+++ b/waltid-libraries/auth/waltid-ktor-authnz/src/main/kotlin/id/walt/ktorauthnz/tokens/jwttoken/JwtTokenHandler.kt
@@ -2,6 +2,7 @@ package id.walt.ktorauthnz.tokens.jwttoken
 
 import id.walt.crypto.keys.Key
 import id.walt.crypto.utils.JwsUtils.decodeJws
+import id.walt.ktorauthnz.exceptions.authCheck
 import id.walt.ktorauthnz.sessions.AuthSession
 import id.walt.ktorauthnz.tokens.TokenHandler
 import kotlinx.datetime.Clock
@@ -28,7 +29,7 @@ class JwtTokenHandler : TokenHandler {
         jwtPayload["exp"]?.jsonPrimitive?.long?.let { exp ->
             val expirationDate = Instant.fromEpochSeconds(exp)
             val now = Clock.System.now()
-            check(now < expirationDate) { "JWT Token expired since: ${now - expirationDate}" }
+            authCheck(now < expirationDate) { "JWT Login Token expired since: ${now - expirationDate}" }
         }
     }
 
diff --git a/waltid-libraries/auth/waltid-ktor-authnz/src/test/kotlin/id/walt/KtorAuthnzE2ETest.kt b/waltid-libraries/auth/waltid-ktor-authnz/src/test/kotlin/id/walt/KtorAuthnzE2ETest.kt
index 295580d5d..19e80688a 100644
--- a/waltid-libraries/auth/waltid-ktor-authnz/src/test/kotlin/id/walt/KtorAuthnzE2ETest.kt
+++ b/waltid-libraries/auth/waltid-ktor-authnz/src/test/kotlin/id/walt/KtorAuthnzE2ETest.kt
@@ -94,7 +94,7 @@ class KtorAuthnzE2ETest {
     }
 
     @Test
-    fun testNonJwt() = runTest(timeout = 10.seconds) {
+    fun testNonJwt() = runTest(timeout = 20.seconds) {
         val s = startExample(wait = false, jwt = false)
 
         implicit1Test()
@@ -104,7 +104,7 @@ class KtorAuthnzE2ETest {
     }
 
     @Test
-    fun testJwt() = runTest(timeout = 10.seconds) {
+    fun testJwt() = runTest(timeout = 20.seconds) {
         val s = startExample(wait = false, jwt = true)
 
         implicit1Test()
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/EccUtils.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/EccUtils.kt
index 8373f5a24..0bde8ca5e 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/EccUtils.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/EccUtils.kt
@@ -1,5 +1,7 @@
 package id.walt.crypto.keys
 
+import kotlin.experimental.and
+
 object EccUtils {
 
 
@@ -88,4 +90,51 @@ object EccUtils {
         return fixedLengthR + fixedLengthS
     }
 
+
+    fun convertP1363toDER(p1363Signature: ByteArray): ByteArray {
+        val keySize = p1363Signature.size / 2
+        if (p1363Signature.size % 2 != 0 || keySize == 0) {
+            throw IllegalArgumentException("Invalid P1363 signature format")
+        }
+
+        // Split P1363 signature into r and s values
+        val r = p1363Signature.sliceArray(0 until keySize)
+        val s = p1363Signature.sliceArray(keySize until p1363Signature.size)
+
+        // Convert r and s to ASN.1 integer encoding
+        val encodedR = encodeAsASN1Integer(r)
+        val encodedS = encodeAsASN1Integer(s)
+
+        // Combine r and s into a DER SEQUENCE
+        val sequenceLength = encodedR.size + encodedS.size
+        val der = mutableListOf<Byte>()
+
+        // DER Sequence: 0x30 [length] [encodedR] [encodedS]
+        der.add(0x30) // Sequence tag
+        der.add(sequenceLength.toByte()) // Length of the sequence
+        der.addAll(encodedR.toList()) // Add r
+        der.addAll(encodedS.toList()) // Add s
+
+        return der.toByteArray()
+    }
+
+    // Helper function to encode a byte array as ASN.1 INTEGER
+    private fun encodeAsASN1Integer(value: ByteArray): ByteArray {
+        val mutableValue = value.toMutableList()
+
+        // If the most significant bit of the first byte is set, prepend a 0x00 byte to avoid interpretation as negative
+        if (mutableValue[0] and 0x80.toByte() != 0.toByte()) {
+            mutableValue.add(0, 0x00)
+        }
+
+        val length = mutableValue.size
+        val asn1Integer = mutableListOf<Byte>()
+
+        // ASN.1 Integer: 0x02 [length] [value]
+        asn1Integer.add(0x02) // Integer tag
+        asn1Integer.add(length.toByte()) // Length of the integer
+        asn1Integer.addAll(mutableValue) // The value itself
+
+        return asn1Integer.toByteArray()
+    }
 }
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyManager.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyManager.kt
index a9e8ed6bd..792d8f58d 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyManager.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyManager.kt
@@ -4,6 +4,7 @@ import id.walt.crypto.exceptions.KeyBackendNotSupportedException
 import id.walt.crypto.exceptions.KeyTypeMissingException
 import id.walt.crypto.exceptions.KeyTypeNotSupportedException
 import id.walt.crypto.keys.aws.AWSKey
+import id.walt.crypto.keys.azure.AzureKey
 import id.walt.crypto.keys.jwk.JWKKey
 import id.walt.crypto.keys.oci.OCIKeyRestApi
 import id.walt.crypto.keys.tse.TSEKey
@@ -43,6 +44,13 @@ object KeyManager {
                 Json.decodeFromJsonElement(generateRequest.config!!)
             )
         }
+
+        register<AzureKey>("azure") { generateRequest: KeyGenerationRequest ->
+            AzureKey.generate(
+                generateRequest.keyType,
+                Json.decodeFromJsonElement(generateRequest.config!!)
+            )
+        }
     }
 
     fun registerByType(type: KType, typeId: String, createFunction: suspend (KeyGenerationRequest) -> Key) {
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyMeta.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyMeta.kt
index d62de28a2..7141bc1e3 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyMeta.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyMeta.kt
@@ -28,4 +28,9 @@ data class JwkKeyMeta(
 data class AwsKeyMeta(
     override val keyId: String,
     val keySize: Int? = null,
-) : KeyMeta()
\ No newline at end of file
+) : KeyMeta()
+
+@Serializable
+data class AzureKeyMeta(
+    override val keyId: String
+) : KeyMeta()
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeySerialization.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeySerialization.kt
index 73eb920bc..a15119e7b 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeySerialization.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeySerialization.kt
@@ -1,6 +1,7 @@
 package id.walt.crypto.keys
 
 import id.walt.crypto.keys.aws.AWSKey
+import id.walt.crypto.keys.azure.AzureKey
 import id.walt.crypto.keys.jwk.JWKKey
 import id.walt.crypto.keys.oci.OCIKeyRestApi
 import id.walt.crypto.keys.tse.TSEKey
@@ -28,6 +29,7 @@ object KeySerialization {
             subclass(TSEKey::class)
             subclass(OCIKeyRestApi::class)
             subclass(AWSKey::class)
+            subclass(AzureKey::class)
         }
     }
 
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyUtils.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyUtils.kt
new file mode 100644
index 000000000..385d27c4f
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/KeyUtils.kt
@@ -0,0 +1,39 @@
+package id.walt.crypto.keys
+
+import id.walt.crypto.utils.Base64Utils.encodeToBase64Url
+import id.walt.crypto.utils.JsonUtils.toJsonElement
+import id.walt.crypto.utils.jwsSigningAlgorithm
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonElement
+
+object KeyUtils {
+
+
+    fun rawSignaturePayloadForJws(
+        plaintext: ByteArray,
+        headers: Map<String, JsonElement>,
+        keyType: KeyType,
+    ): Triple<String, String, ByteArray> {
+        val appendedHeader = HashMap(headers).apply {
+            put("alg", jwsSigningAlgorithm(keyType).toJsonElement())
+        }
+
+        val header = Json.encodeToString(appendedHeader).encodeToByteArray().encodeToBase64Url()
+        val payload = plaintext.encodeToBase64Url()
+
+        return Triple(header, payload, "$header.$payload".encodeToByteArray())
+    }
+
+    fun signJwsWithRawSignature(
+        rawSignature: ByteArray,
+        header: String,
+        payload: String
+    ): String {
+        val encodedSignature = rawSignature.encodeToBase64Url()
+        val jws = "$header.$payload.$encodedSignature"
+
+        return jws
+    }
+
+}
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/aws/AWSKey.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/aws/AWSKey.kt
index 0ece095a0..fac1482c9 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/aws/AWSKey.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/aws/AWSKey.kt
@@ -306,7 +306,7 @@ class AWSKey(
 
 
     companion object : AWSKeyCreator {
-        val client = HttpClient()
+        private val client = HttpClient()
 
         @JsExport.Ignore
         suspend fun authAccess(config: AWSKeyMetadata) {
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureAuth.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureAuth.kt
new file mode 100644
index 000000000..91b05b4b4
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureAuth.kt
@@ -0,0 +1,16 @@
+package id.walt.crypto.keys.azure
+
+import kotlinx.serialization.Serializable
+import kotlin.js.ExperimentalJsExport
+import kotlin.js.JsExport
+
+
+@OptIn(ExperimentalJsExport::class)
+@JsExport
+@Serializable
+data class AzureAuth(
+    val clientId: String,
+    val clientSecret: String,
+    val tenantId: String,
+    val keyVaultUrl: String,
+)
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKey.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKey.kt
new file mode 100644
index 000000000..f5b9e6ac1
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKey.kt
@@ -0,0 +1,432 @@
+package id.walt.crypto.keys.azure
+
+import id.walt.crypto.exceptions.KeyTypeNotSupportedException
+import id.walt.crypto.keys.*
+import id.walt.crypto.keys.KeyUtils.rawSignaturePayloadForJws
+import id.walt.crypto.keys.KeyUtils.signJwsWithRawSignature
+import id.walt.crypto.keys.azure.AzureKey.AzureKeyFunctions.azureJsonDataBody
+import id.walt.crypto.keys.azure.AzureKey.AzureKeyFunctions.fetchAccessToken
+import id.walt.crypto.keys.azure.AzureKey.AzureKeyFunctions.keyTypeToAzureKeyMapping
+import id.walt.crypto.keys.azure.AzureKey.AzureKeyFunctions.parseAzurePublicKey
+import id.walt.crypto.keys.jwk.JWKKey
+import id.walt.crypto.utils.Base64Utils.decodeFromBase64Url
+import id.walt.crypto.utils.Base64Utils.encodeToBase64Url
+import id.walt.crypto.utils.jwsSigningAlgorithm
+import io.github.oshai.kotlinlogging.KotlinLogging
+import io.ktor.client.*
+import io.ktor.client.call.*
+import io.ktor.client.plugins.contentnegotiation.*
+import io.ktor.client.request.*
+import io.ktor.client.statement.*
+import io.ktor.http.*
+import io.ktor.serialization.kotlinx.json.*
+import kotlinx.datetime.Clock
+import kotlinx.datetime.Instant
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.Transient
+import kotlinx.serialization.json.*
+import love.forte.plugin.suspendtrans.annotation.JsPromise
+import love.forte.plugin.suspendtrans.annotation.JvmAsync
+import love.forte.plugin.suspendtrans.annotation.JvmBlocking
+import org.kotlincrypto.hash.sha2.SHA256
+import kotlin.io.encoding.ExperimentalEncodingApi
+import kotlin.js.ExperimentalJsExport
+import kotlin.js.JsExport
+import kotlin.random.Random
+import kotlin.time.Duration.Companion.seconds
+
+private val logger = KotlinLogging.logger { }
+
+@OptIn(ExperimentalJsExport::class)
+@JsExport
+@Serializable
+@SerialName("azure")
+class AzureKey(
+    val id: String,
+    val auth: AzureAuth,
+    private var _keyType: KeyType? = null,
+    private var _publicKey: DirectSerializedKey? = null
+) : Key() {
+
+    @Transient
+    private lateinit var accessToken: String
+
+    @Transient
+    private lateinit var accessTokenExpiration: Instant
+
+    private fun updateKeyType() {
+        _keyType = _publicKey?.key?.keyType
+    }
+
+    @JsExport.Ignore
+    suspend fun fetchAndUpdatePublicKey() {
+        _publicKey = DirectSerializedKey(getPublicKeyFromAzureKms(getKeyId()))
+    }
+
+    @JsExport.Ignore
+    suspend fun updateAccessToken() {
+        val accessTokenResponse = fetchAccessToken(auth)
+
+        accessToken = accessTokenResponse.accessToken
+        accessTokenExpiration = accessTokenResponse.expiration
+    }
+
+    @JsExport.Ignore
+    suspend fun ensureAccessTokenValid() {
+        if (!this::accessToken.isInitialized || accessTokenExpiration >= Clock.System.now()) {
+            updateAccessToken()
+        }
+    }
+
+    @JsExport.Ignore
+    override suspend fun init() {
+        ensureAccessTokenValid()
+
+        if (_publicKey == null) fetchAndUpdatePublicKey()
+        if (_keyType == null) updateKeyType()
+    }
+
+    override var keyType: KeyType
+        get() = _keyType ?: error("Getting keyType without calling init() first")
+        set(value) {
+            _keyType = value
+        }
+
+    override val hasPrivateKey: Boolean
+        get() = false
+
+    override fun toString(): String = "[Azure ${keyType.name} key @ ${auth.keyVaultUrl} - $id]"
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun getKeyId(): String = id
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun getThumbprint(): String = throw UnsupportedOperationException("No private key available")
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun exportJWK(): String = throw UnsupportedOperationException("No private key available")
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun exportJWKObject(): JsonObject = throw UnsupportedOperationException("No private key available")
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun exportPEM(): String = throw UnsupportedOperationException("No private key available")
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    @OptIn(ExperimentalStdlibApi::class)
+    /**
+     * Executes Azure sign operation, and converts Azure signature to DER by default (for ECC keys)
+     * @param ieeeP1363Signature set to true to leave signature in Azure IEEE P1363 format (no conversion)
+     */
+    suspend fun signRawAzure(plaintext: ByteArray, ieeeP1363Signature: Boolean): ByteArray {
+        ensureAccessTokenValid()
+
+        val sha256Digest: ByteArray = SHA256().digest(plaintext)
+        val base64UrlEncoded: String = sha256Digest.encodeToBase64Url()
+
+        val signingAlgorithm = jwsSigningAlgorithm(keyType)
+
+        val body = buildJsonObject {
+            put("alg", JsonPrimitive(signingAlgorithm))
+            put("value", JsonPrimitive(base64UrlEncoded))
+        }
+        val signatureResponse = client.post("$id/sign?api-version=7.4") {
+            contentType(ContentType.Application.Json)
+            bearerAuth(accessToken)
+            setBody(body)
+        }
+        var signature = signatureResponse.azureJsonDataBody()["value"]!!.jsonPrimitive.content.decodeFromBase64Url()
+
+        // Convert signature from Azure IEEE P1363 to default DER format for raw sign
+        // if not explicitly asked to leave it in IEEE P1363 with `ieeeP1363Signature`
+        if (!ieeeP1363Signature && keyType in listOf(KeyType.secp256r1, KeyType.secp256k1)) {
+            signature = EccUtils.convertP1363toDER(signature)
+        }
+
+        return signature
+    }
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    @OptIn(ExperimentalStdlibApi::class)
+    override suspend fun signRaw(plaintext: ByteArray): ByteArray {
+        return signRawAzure(plaintext, ieeeP1363Signature = false)
+    }
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    @OptIn(ExperimentalEncodingApi::class)
+    override suspend fun signJws(
+        plaintext: ByteArray,
+        headers: Map<String, JsonElement>
+    ): String {
+        val (header, payload, toSign) = rawSignaturePayloadForJws(plaintext, headers, keyType)
+        val rawSignature = signRawAzure(toSign, ieeeP1363Signature = true)
+        val jws = signJwsWithRawSignature(rawSignature, header, payload)
+
+        return jws
+    }
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    @OptIn(ExperimentalEncodingApi::class)
+    override suspend fun verifyRaw(
+        signed: ByteArray,
+        detachedPlaintext: ByteArray?
+    ): Result<ByteArray> {
+
+        val publicKey = getPublicKey()
+        val verification = publicKey.verifyRaw(signed, detachedPlaintext)
+        return Result.success(
+            verification.getOrThrow()
+        )
+    }
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    @OptIn(ExperimentalEncodingApi::class)
+    override suspend fun verifyJws(signedJws: String): Result<JsonElement> {
+        val publicKey = getPublicKey()
+        val verification = publicKey.verifyJws(signedJws)
+        return verification
+    }
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun getPublicKey(): Key = _publicKey?.key ?: error("Init was not called before public key was requested")
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun getPublicKeyRepresentation(): ByteArray = getPublicKey().getPublicKeyRepresentation()
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun getMeta(): KeyMeta = AzureKeyMeta(getKeyId())
+
+    @JvmBlocking
+    @JvmAsync
+    @JsPromise
+    @JsExport.Ignore
+    override suspend fun deleteKey(): Boolean {
+        ensureAccessTokenValid()
+        val response = client.delete("$id?api-version=7.4") {
+            contentType(ContentType.Application.Json)
+            bearerAuth(accessToken)
+        }
+        return response.status.isSuccess()
+    }
+
+    @Serializable
+    data class KeyCreateRequest(
+        val kty: String,
+        val crv: String? = null,
+        @SerialName("key_size")
+        val keySize: Int? = null,
+        @SerialName("key_ops")
+        val keyOps: List<String>,
+    )
+
+
+    @JsExport.Ignore
+    suspend fun getPublicKeyFromAzureKms(keyId: String): Key {
+        ensureAccessTokenValid()
+
+        val keyResponse = client.get("$keyId?api-version=7.4") {
+            contentType(ContentType.Application.Json)
+            bearerAuth(accessToken)
+        }.azureJsonDataBody()
+
+        val publicKeyJson = (keyResponse["key"] ?: error("Missing key in response")).jsonObject
+
+        val parsedAzurePublicKey = parseAzurePublicKey(publicKeyJson)
+
+        return parsedAzurePublicKey.publicKey
+    }
+
+    object AzureKeyFunctions {
+        internal fun keyTypeToAzureKeyMapping(type: KeyType): Pair<String, String?> = when (type) {
+            KeyType.secp256r1 -> "EC" to "P-256"  // EC key with P-256 curve
+            KeyType.secp256k1 -> "EC" to "P-256K" // EC key with P-256K curve
+            KeyType.RSA -> "RSA" to null  // RSA key, no curve
+            else -> throw KeyTypeNotSupportedException(type.name)
+        }
+
+        internal fun azureKeyToKeyTypeMapping(crv: String, kty: String): KeyType = when (kty) {
+            "EC" -> when (crv) {
+                "P-256" -> KeyType.secp256r1  // Mapping P-256 curve to secp256r1
+                "P-256K" -> KeyType.secp256k1 // Mapping P-256K curve to secp256k1
+                else -> throw KeyTypeNotSupportedException(crv)
+            }
+
+            "RSA" -> KeyType.RSA  // Mapping RSA key type
+            else -> throw KeyTypeNotSupportedException(kty)
+        }
+
+        data class ParsedAzurePublicKey(
+            val kid: String,
+            val azureKeyType: String,
+            val curve: String?,
+            val keyType: KeyType,
+            val publicKey: JWKKey
+        )
+
+        internal suspend fun parseAzurePublicKey(publicKeyJson: JsonObject): ParsedAzurePublicKey {
+            val kid = publicKeyJson["kid"]?.jsonPrimitive?.content ?: error("No key id in key response")
+            val azureKeyType = publicKeyJson["kty"]?.jsonPrimitive?.content ?: error("Missing key type in public key response")
+            val crvFromResponse = publicKeyJson["crv"]?.jsonPrimitive?.content
+
+            val publicKey = JWKKey.importJWK(publicKeyJson.toString())
+                .getOrElse { exception -> throw IllegalArgumentException("Invalid JWK in public key: $publicKeyJson", exception) }
+
+            val keyType = azureKeyToKeyTypeMapping(crvFromResponse ?: "", azureKeyType)
+
+            return ParsedAzurePublicKey(kid, azureKeyType, crvFromResponse, keyType, publicKey)
+        }
+
+
+        @JvmBlocking
+        @JvmAsync
+        @JsPromise
+        @JsExport.Ignore
+        suspend fun fetchAccessToken(auth: AzureAuth): AzureTokenResponseParsed {
+            require(auth.tenantId.all { it.lowercase() in "abcdef0123456789-" }) { "Tenant id contains invalid characters: ${auth.tenantId}" }
+
+            val time = Clock.System.now()
+            val response = client.post("https://login.microsoftonline.com/${auth.tenantId}/oauth2/v2.0/token") {
+                contentType(ContentType.Application.FormUrlEncoded)
+                setBody(
+                    listOf(
+                        "grant_type" to "client_credentials",
+                        "client_id" to auth.clientId,
+                        "client_secret" to auth.clientSecret,
+                        "scope" to "https://vault.azure.net/.default"
+                    ).formUrlEncode()
+                )
+            }.run {
+                runCatching { body<AzureTokenResponse>() }.getOrElse { ex ->
+                    throw IllegalArgumentException("Could not retrieve access token: ${bodyAsText()}", ex)
+                }
+            }
+
+            check(response.tokenType.lowercase() == "bearer") { "Can only handle bearer access tokens!" }
+
+            return AzureTokenResponseParsed(
+                accessToken = response.accessToken,
+                expiration = time + response.expiresIn.seconds
+            )
+        }
+
+        internal suspend fun HttpResponse.azureJsonDataBody(): JsonObject {
+            val baseMsg = { "Azure server (URL: ${this.request.url}) returned an invalid response: " }
+
+            return runCatching { body<JsonObject>() }.getOrElse {
+                val bodyStr = this.bodyAsText() // Get the body in case of an exception
+                throw IllegalArgumentException(
+                    baseMsg.invoke() + if (bodyStr.isEmpty()) "empty response (instead of JSON data)"
+                    else "invalid response: $bodyStr",
+                    it
+                )
+            }
+        }
+
+        @Serializable
+        data class AzureTokenResponse(
+            @SerialName("token_type")
+            val tokenType: String,
+
+            @SerialName("expires_in")
+            val expiresIn: Int,
+
+            @SerialName("ext_expires_in")
+            val extExpiresIn: Int,
+
+            @SerialName("access_token")
+            val accessToken: String
+        )
+
+        @Serializable
+        data class AzureTokenResponseParsed(
+            val accessToken: String,
+            val expiration: Instant
+        )
+    }
+
+    companion object : AzureKeyCreator {
+        private val client = HttpClient {
+            install(ContentNegotiation) {
+                json(Json { prettyPrint = true })
+            }
+        }
+
+        @JsExport.Ignore
+        override suspend fun generate(type: KeyType, metadata: AzureKeyMetadata): AzureKey {
+            val keyName = metadata.name ?: Random.nextInt().toString()
+
+            val accessTokenResponse = fetchAccessToken(metadata.auth)
+
+            val (kty, crv) = keyTypeToAzureKeyMapping(type)
+            val keyRequestBody = if (kty == "RSA") {
+                KeyCreateRequest(
+                    kty = kty,
+                    keyOps = listOf("sign", "verify"),
+                    keySize = 2048
+                )
+            } else {
+                KeyCreateRequest(
+                    kty = kty,
+                    crv = crv!!,
+                    keyOps = listOf("sign", "verify")
+                )
+            }
+            val response = client.post("${metadata.auth.keyVaultUrl}/keys/$keyName/create?api-version=7.4") {
+                contentType(ContentType.Application.Json)
+                bearerAuth(accessTokenResponse.accessToken)
+                setBody(keyRequestBody)
+            }.azureJsonDataBody()
+
+            val parsedAzurePublicKey = parseAzurePublicKey(response.jsonObject["key"]?.jsonObject!!)
+
+            val keyId = parsedAzurePublicKey.kid
+
+            return AzureKey(
+                id = keyId,
+                auth = metadata.auth,
+                _keyType = parsedAzurePublicKey.keyType,
+                _publicKey = DirectSerializedKey(parsedAzurePublicKey.publicKey)
+            )
+        }
+    }
+}
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyCreator.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyCreator.kt
new file mode 100644
index 000000000..b49bbf3d7
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyCreator.kt
@@ -0,0 +1,9 @@
+package id.walt.crypto.keys.azure
+
+import id.walt.crypto.keys.KeyType
+
+
+interface AzureKeyCreator {
+
+    suspend fun generate(type: KeyType, metadata: AzureKeyMetadata): AzureKey
+}
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyMetadata.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyMetadata.kt
new file mode 100644
index 000000000..b7ed6408e
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/azure/AzureKeyMetadata.kt
@@ -0,0 +1,20 @@
+package id.walt.crypto.keys.azure
+
+import kotlinx.serialization.Serializable
+import kotlin.random.Random
+
+
+@Serializable
+data class AzureKeyMetadata(
+    val auth: AzureAuth,
+    val name: String? = null
+) {
+    constructor(
+        clientId: String,
+        clientSecret: String,
+        keyVaultUrl: String,
+        tenantId: String,
+        name: String = Random.nextInt().toString()
+    ) : this(AzureAuth(clientId, clientSecret, tenantId, keyVaultUrl), name = name)
+}
+
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.kt b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.kt
index eb7e49075..5f3650652 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.kt
@@ -8,7 +8,10 @@ import kotlinx.serialization.descriptors.SerialDescriptor
 import kotlinx.serialization.encodeToString
 import kotlinx.serialization.encoding.Decoder
 import kotlinx.serialization.encoding.Encoder
-import kotlinx.serialization.json.*
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonElement
+import kotlinx.serialization.json.JsonNull
+import kotlinx.serialization.json.JsonObject
 
 expect class JWKKey(jwk: String?, _keyId: String? = null) : Key {
     override val keyType: KeyType
diff --git a/waltid-libraries/crypto/waltid-crypto/src/commonTest/kotlin/AzureKeyTest.kt b/waltid-libraries/crypto/waltid-crypto/src/commonTest/kotlin/AzureKeyTest.kt
new file mode 100644
index 000000000..c0612aa19
--- /dev/null
+++ b/waltid-libraries/crypto/waltid-crypto/src/commonTest/kotlin/AzureKeyTest.kt
@@ -0,0 +1,124 @@
+import AzureKeyTest.Config.payloadJWS
+import id.walt.crypto.keys.KeyType
+import id.walt.crypto.keys.azure.AzureAuth
+import id.walt.crypto.keys.azure.AzureKey
+import id.walt.crypto.keys.azure.AzureKeyMetadata
+import io.ktor.utils.io.core.*
+import kotlinx.coroutines.test.runTest
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlin.test.Test
+import kotlin.test.assertEquals
+import kotlin.test.assertNotNull
+import kotlin.test.assertTrue
+
+
+class AzureKeyTest {
+
+    private object Config {
+        val clientId = ""
+        val clientSecret = ""
+        val tenantId = ""
+        val keyVaultUrl = ""
+
+        val payloadJWS = JsonObject(
+            mapOf(
+                "sub" to JsonPrimitive("16bb17e0-e733-4622-9384-122bc2fc6290"),
+                "iss" to JsonPrimitive("http://localhost:3000"),
+                "aud" to JsonPrimitive("TOKEN"),
+            )
+        )
+        val payload = "Hello, World!"
+
+        val TESTABLE_KEY_TYPES = listOf(KeyType.RSA, KeyType.secp256r1)
+
+
+    }
+
+    private fun isConfigAvailable() = runCatching {
+        Config.clientId.isNotEmpty() && Config.clientSecret.isNotEmpty()
+    }.fold(onSuccess = { it }, onFailure = { false })
+
+
+    lateinit var keys: List<AzureKey>
+
+
+    @Test
+    fun testAzure() = runTest {
+        isConfigAvailable().takeIf { it }?.let {
+            println("Testing key creation of: ${Config.TESTABLE_KEY_TYPES}...")
+            azureTestKeyCreation()
+
+            println("Testing resolving to public key for: $keys...")
+            azureTestPublicKeys()
+
+            println("Testing sign & verify raw (payload: ${Config.payload})...")
+            azureTestSignRaw()
+
+            println("Testing sign & verify JWS (payload: ${Config.payloadJWS})...")
+            azureTestSignJws()
+
+
+            println("Testing key deletion...")
+            azureTestDeleteKey()
+        }
+    }
+
+    private suspend fun azureTestKeyCreation() {
+        val azureMetadata = AzureKeyMetadata(
+            auth = AzureAuth(
+                clientId = Config.clientId,
+                clientSecret = Config.clientSecret,
+                tenantId = Config.tenantId,
+                keyVaultUrl = Config.keyVaultUrl
+            )
+        )
+
+        keys = Config.TESTABLE_KEY_TYPES.map {
+            AzureKey.generate(it, azureMetadata).also { key ->
+                println("Generated key: ${key.keyType} - ${key.getKeyId()}")
+                assertNotNull(key, "Key generation failed for $it")
+                assertNotNull(key.getKeyId(), "Key ID should not be null")
+                assertTrue(key.getKeyId().isNotBlank(), "Key ID should not be blank")
+                assertEquals(it, key.keyType, "Key type does not match expected value")
+            }
+        }
+    }
+
+    private suspend fun azureTestPublicKeys() {
+        keys.forEach {
+            println("Public key: ${it.getPublicKey().exportJWK()}")
+        }
+    }
+
+    private suspend fun azureTestSignRaw() {
+        keys.forEach { key ->
+            println("RAW sign/verification test with key type: ${key.keyType}")
+            val signature = key.signRaw(Config.payload.toByteArray())
+            val verified = key.verifyRaw(signature, Config.payload.toByteArray())
+            assertNotNull(signature, "Signature should not be null")
+            assertTrue(signature.isNotEmpty(), "Signature should not be empty")
+            assertTrue(verified.isSuccess, "Raw signature verification failed")
+        }
+    }
+
+    private suspend fun azureTestSignJws() {
+        keys.forEach { key ->
+            println("JWS sign/verification test with key type: ${key.keyType}")
+            val signature = key.signJws(payloadJWS.toString().toByteArray())
+            val verified = key.verifyJws(signature)
+            assertNotNull(signature, "JWS signature should not be null")
+            assertTrue(signature.isNotEmpty(), "JWS signature should not be empty")
+            assertTrue(verified.isSuccess, "JWS signature verification failed")
+            assertEquals(payloadJWS, verified.getOrThrow(), "JWS payload mismatch after verification")
+        }
+    }
+
+    private suspend fun azureTestDeleteKey() {
+        keys.forEach { key ->
+            println("Deleting key: ${key.getKeyId()}")
+            key.deleteKey()
+        }
+    }
+
+}
\ No newline at end of file
diff --git a/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/JWKKeyGenerator.jvm.kt b/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/JWKKeyGenerator.jvm.kt
index 3a3e184ba..15efd5441 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/JWKKeyGenerator.jvm.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/JWKKeyGenerator.jvm.kt
@@ -13,6 +13,10 @@ import com.nimbusds.jose.jwk.gen.RSAKeyGenerator
 import com.nimbusds.jose.util.Base64URL
 import id.walt.crypto.keys.jwk.JWKKey
 import id.walt.crypto.keys.jwk.JWKKeyCreator
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.jsonPrimitive
 import org.bouncycastle.asn1.ASN1BitString
 import org.bouncycastle.asn1.ASN1Integer
 import org.bouncycastle.asn1.ASN1Sequence
@@ -22,6 +26,7 @@ import org.bouncycastle.math.ec.ECPoint
 import java.security.KeyFactory
 import java.security.interfaces.RSAPublicKey
 import java.security.spec.RSAPublicKeySpec
+import java.text.ParseException
 
 object JvmJWKKeyCreator : JWKKeyCreator {
 
@@ -52,8 +57,30 @@ object JvmJWKKeyCreator : JWKKeyCreator {
             }
         )
 
+    /**
+     * Parse JWK with the Nimbus library, and rewrite Secp256k1 if required.
+     *
+     * This rewriter is required due to Microsoft Azure Key Vault not adhering to [RFC 8812 section 3.1](https://datatracker.ietf.org/doc/html/rfc8812#section-3.1)
+     * and instead using a non-standard string [Azure Key Vault docs](https://learn.microsoft.com/en-us/rest/api/keyvault/keys/create-key/create-key?view=rest-keyvault-keys-7.4&tabs=HTTP#jsonwebkeycurvename)
+     */
+    private fun nimbusJwkParsing(jwkString: String): JWK {
+        try {
+            return JWK.parse(jwkString)
+        } catch (e: ParseException) {
+            if (e.message == "Unknown / unsupported curve: P-256K") {
+                var jsonObject = Json.decodeFromString<JsonObject>(jwkString)
+                if (jsonObject["crv"]?.jsonPrimitive?.content?.uppercase() == "P-256K") {
+                    jsonObject = JsonObject(jsonObject.toMutableMap().apply {
+                        this["crv"] = JsonPrimitive("secp256k1")
+                    })
+                    return JWK.parse(jsonObject.toString())
+                } else throw e
+            } else throw e
+        }
+    }
+
     override suspend fun importJWK(jwk: String): Result<JWKKey> =
-        runCatching { JWKKey(JWK.parse(jwk)) }
+        runCatching { JWKKey(nimbusJwkParsing(jwk)) }
 
     override suspend fun importPEM(pem: String): Result<JWKKey> =
         runCatching { JWKKey(JWK.parseFromPEMEncodedObjects(pem)) }
diff --git a/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.jvm.kt b/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.jvm.kt
index 90723c104..4834702d2 100644
--- a/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.jvm.kt
+++ b/waltid-libraries/crypto/waltid-crypto/src/jvmMain/kotlin/id/walt/crypto/keys/jwk/JWKKey.jvm.kt
@@ -88,6 +88,7 @@ actual class JWKKey actual constructor(
             when (value) {
                 is String -> JsonPrimitive(value)
                 is Number -> JsonPrimitive(value)
+                is ArrayList<*> -> JsonPrimitive(value.toString())
                 else -> throw IllegalArgumentException("Unsupported value type: ${value::class.simpleName} in field ${it.key}")
 
             }
@@ -254,7 +255,6 @@ actual class JWKKey actual constructor(
     actual override suspend fun verifyRaw(signed: ByteArray, detachedPlaintext: ByteArray?): Result<ByteArray> {
         check(detachedPlaintext != null) { "Detached plaintext is required." }
 
-
         if (keyType == KeyType.Ed25519) {
             val tinkVerifier = Ed25519Verify(_internalJwk.toOctetKeyPair().toPublicJWK().decodedX)
             return runCatching { tinkVerifier.verify(signed, detachedPlaintext) }.map { detachedPlaintext }
diff --git a/waltid-libraries/waltid-core-wallet/src/jvmTest/kotlin/id/walt/wallet/core/EntraTest.kt b/waltid-libraries/waltid-core-wallet/src/jvmTest/kotlin/id/walt/wallet/core/EntraTest.kt
index aca63c47e..251851dae 100644
--- a/waltid-libraries/waltid-core-wallet/src/jvmTest/kotlin/id/walt/wallet/core/EntraTest.kt
+++ b/waltid-libraries/waltid-core-wallet/src/jvmTest/kotlin/id/walt/wallet/core/EntraTest.kt
@@ -9,6 +9,7 @@ import kotlinx.coroutines.test.runTest
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.jsonPrimitive
 import kotlin.test.Test
+import kotlin.time.Duration.Companion.minutes
 
 class EntraTest : BaseTest() {
 
@@ -49,7 +50,7 @@ class EntraTest : BaseTest() {
     }
 
     @Test
-    fun testEntraFlow() = runTest {
+    fun testEntraFlow() = runTest(timeout = 3.minutes) {
         val receivedCredentials = entraFlowIssuance()
         entraFlowVerification(receivedCredentials)
     }
diff --git a/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuanceExamples.kt b/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuanceExamples.kt
index 352afc28f..c1e90b641 100644
--- a/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuanceExamples.kt
+++ b/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuanceExamples.kt
@@ -5,7 +5,10 @@ import id.walt.credentials.utils.VCFormat
 import id.walt.crypto.keys.KeyType
 import id.walt.issuer.lspPotential.LspPotentialIssuanceInterop
 import io.github.smiley4.ktorswaggerui.dsl.routes.ValueExampleDescriptorDsl
-import kotlinx.serialization.json.*
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.add
+import kotlinx.serialization.json.buildJsonArray
 
 object IssuanceExamples {
 
@@ -911,6 +914,33 @@ object IssuanceExamples {
         """.trimIndent()
     )
 
+    //language=JSON
+    val issuerOnboardingRequestAzureRestApiExample = typedValueExampleDescriptorDsl<OnboardingRequest>(
+        """
+            {
+                "key":
+                {
+                    "backend": "azure",
+                    "keyType": "secp256r1",
+                    "config":
+                    {
+                       "auth": {
+                            "clientId": "client id",
+                            "clientSecret": "client secret",
+                            "tenantId": "tenant id",
+                            "keyVaultUrl": "url to the vault"
+                       }
+                      
+                    }
+                },
+                "did":
+                {
+                    "method": "jwk"
+                }
+            }
+        """.trimIndent()
+    )
+
     //language=JSON
     val issuerOnboardingResponseOciRestApiExample = typedValueExampleDescriptorDsl<IssuerOnboardingResponse>(
         """
@@ -1003,6 +1033,7 @@ object IssuanceExamples {
         """.trimIndent()
     )
 
+
     // language=JSON
     val issuerOnboardingResponseTseExample = typedValueExampleDescriptorDsl<IssuerOnboardingResponse>(
         """
diff --git a/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuerApi.kt b/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuerApi.kt
index b89c57cf4..22eabd892 100644
--- a/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuerApi.kt
+++ b/waltid-services/waltid-issuer-api/src/main/kotlin/id/walt/issuer/issuance/IssuerApi.kt
@@ -22,7 +22,10 @@ import io.ktor.server.request.*
 import io.ktor.server.response.*
 import io.ktor.server.routing.*
 import io.ktor.util.pipeline.*
-import kotlinx.serialization.json.*
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
 import redis.clients.jedis.exceptions.JedisAccessControlException
 import redis.clients.jedis.exceptions.JedisConnectionException
 import kotlin.reflect.KClass
@@ -121,6 +124,10 @@ fun Application.issuerApi() {
                             "did:jwk + AWS REST API key  (AWS - Secp256r1) + Role (Auth)",
                             IssuanceExamples.issuerOnboardingRequestAwsRestApiExampleWithRole
                         )
+                        example(
+                            "did:jwk + Azure REST API key  (Azure - Secp256r1)",
+                            IssuanceExamples.issuerOnboardingRequestAzureRestApiExample
+                        )
                         required = true
                     }
                 }
diff --git a/waltid-services/waltid-wallet-api/src/main/kotlin/id/walt/webwallet/web/controllers/KeyController.kt b/waltid-services/waltid-wallet-api/src/main/kotlin/id/walt/webwallet/web/controllers/KeyController.kt
index a1b0e0f16..cfc386bb0 100644
--- a/waltid-services/waltid-wallet-api/src/main/kotlin/id/walt/webwallet/web/controllers/KeyController.kt
+++ b/waltid-services/waltid-wallet-api/src/main/kotlin/id/walt/webwallet/web/controllers/KeyController.kt
@@ -11,7 +11,7 @@ import io.ktor.http.*
 import io.ktor.server.application.*
 import io.ktor.server.request.*
 import io.ktor.server.response.*
-import io.ktor.server.util.getOrFail
+import io.ktor.server.util.*
 import kotlinx.coroutines.runBlocking
 import kotlinx.serialization.json.JsonObject
 import kotlinx.serialization.json.JsonPrimitive
@@ -115,6 +115,20 @@ fun Application.keys() = walletRoute {
                             }
                         )
                     }
+                    example("Azure key generation request") {
+                        value = KeyGenerationRequest(
+                            backend = "azure",
+                            keyType = KeyType.secp256r1,
+                            config = buildJsonObject {
+                                putJsonObject("auth") {
+                                    put("clientId", JsonPrimitive("clientId"))
+                                    put("clientSecret", JsonPrimitive("clientSecret"))
+                                    put("tenantId", JsonPrimitive("tenantId"))
+                                    put("keyVaultUrl", JsonPrimitive("keyVaultUrl"))
+                                }
+                            }
+                        )
+                    }
                 }
             }
             response {