Every tenant signs tokens with its own keys, encrypted at rest — that's included. The billed line appears when you upgrade a tenant to non-exportable key custody: the private key is generated inside a managed key service (AWS KMS) and never leaves it. Signing happens by calling that service, so the key cannot be copied out by anyone — including us. Billed per key.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article