Create an Encryption Key for Marketing Cloud Engagement

Create an encryption key for Marketing Cloud Engagement activities.

1. In Setup, under Data Management, select Key Management.
2. Click Create.
3. Choose the type of key to create.
4. For Name, enter a name for the key.
5. Leave the External Key field blank.
   After the first handshake, Marketing Cloud Engagement automatically populates this field with the key from the external provider.
6. Complete the appropriate fields for your encryption type.

   Encryption Type	Description
   Asymmetric keys	Click Choose File. Select the .pfx or .asc file for your keys, and click OK. Use public asymmetric keys for file transfer encryption from a safehouse location to another file location. Use private asymmetric keys for file transfer decryption. Select private key and enter your passphrase if applicable.
   Symmetric keys	Enter the key passphrase.
   Initialization vector (IV) keys	In the IV field, enter the key value.
   Salt keys	In the Salt field, enter the key value.
   SSH keys	Upload the key value to use. For SSH keys used in SFTP authentication, select Public Key. Engagement uses the public key value for SFTP user authentication. For file transfer activities, such as reports and imports, use the private key file.
   SSO metadata information	Enter the applicable information. Paste Metadata—Enter the SAML metadata obtained from your third-party identity partner. Guided Configuration Identity Provider Certificate—Click Browse and select the certificate. Entity ID— Enter the entity ID. Name ID Format—Select a format from the dropdown menu. Single Logout Service Location— Enter the URL for the single logout service location. Single Logout Service Binding—Select HTTP REDIRECT or HTTP POST.
   Security context	Grant Type—Select Client Credentials or JWT Bearer. Token Endpoint—Enter the URL of the external web service to call to retrieve an access token. Key ID—Enter the Key ID to pass to the token endpoint as part of the JWT header. Issuer—Enter the Issuer value to pass to the external web service in the JWT payload. Audience—Enter the Audience value to pass to the external web service in the JWT payload. Subject—Enter the Subject value to pass to the external web service in the payload. Valid Service URLs—Enter the URLs that the returned access token applies to. Enter each URL on a new line. Private Key (PEM Format)—Enter the value of the RSA private key to use to encrypt JWT payloads.

7. Click Save.