With Fireblocks Key Link, you can integrate your organization's Key Management solution with the platform. This enables you to leverage the following features:

• Robust wallet management capabilities
• Built-in node infrastructure
• Governance engine
• Transfer network
• Automated compliance functionality 

You can seamlessly manage assets across hot, warm, and air-gapped cold storage environments from a single platform. Manage your key storage in cloud hardware enclaves or with FIPS-certified hardware security models (HSMs) in the cloud or on-prem.

This article assumes your Key Management Infrastructure is based on an HSM. However, we allow the usage of other systems that support this framework. 

Architecture

The Fireblocks Key Link workspace setup differs from the standard Fireblocks MPC-based workspaces by allowing customers to host several key components, as shown in the diagram above.

The following list describes the components and their responsibilities:  

• Fireblocks Agent: A source-available service that you host. It connects to Fireblocks over an outbound connection. It receives signing requests from Fireblocks, verifies them, relays them to your server, and returns the signatures to Fireblocks. The Agent holds no keys and does not sign. For deployment and configuration, see the Fireblocks Agent README.
• Customer Server: Receives signing requests from the Fireblocks Agent, signs them with your HSM, and returns the signatures. You can use KeyLink Flow or build your own server. KeyLink Flow is the companion to Fireblocks Key Link. It is a key management and signing orchestration service that you host. It connects your HSM to Fireblocks in hot mode or in air-gapped cold mode. KeyLink Flow is available with Fireblocks Key Link. Contact your Customer Success Manager for access. A server you build can add custom logic, such as an on-premises policy or transaction validation, to approve or reject signing requests.
• HSM Component: The actual HSM implementation. Can be on-prem, cloud-based, hot or cold HSM, or a different Key Management System.
• Offline signing (cold mode): In cold mode, you carry signing requests as files to an air-gapped server connected to the HSM, then carry the signatures back. KeyLink Flow includes this in its Cold offline component.

Learn more about Getting started with Fireblocks Key Link.  For the fields in a signing request, see Key Link transaction metadata.