---
title: "Fortanix DSM to Create Tokenization Secret"
slug: "fortanix-dsm-to-create-tokenization-secret"
updated: 2026-07-08T16:57:02Z
published: 2026-07-08T16:57:02Z
canonical: "support.fortanix.com/fortanix-dsm-to-create-tokenization-secret"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM to Create Tokenization Secret

## 1.0 Introduction

This article describes the steps to create a tokenization secret in **Fortanix-Data-Security-Manager (DSM)**.

## 2.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 2.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 2.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(5).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 2.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(6).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a title for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 2.4 Creating a Tokenization Secret

Once the group is created, configure any of the policies for the group that are required by your organization, such as the Quorum approval policy, Key undo policy (for sensitive key operations), Cryptographic-policy, and Key custodian policy.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Group-Tokenization-Full-Screen.png)

**Figure 3: Configure DSM policy**

Perform the following steps to add an app to the **Tokenization** group:

1. Go to the detailed view of the group, on the **INFO** tab, click **NEW APP**.
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default API Key as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
3. Click **SAVE** to add the new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_App_Created.png)

**Figure 4: Add application**

Perform the following steps to add a security object to the **Tokenization** group:

1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.
2. On the **Add new Security Object** page:
  1. **Security Object Name**: Enter a name for your security object.
  2. Select **GENERATE**.
  3. In the **Choose a type** section, select the **Tokenization** key type.
  4. In the **Key Size** section, select the required key size from the drop down menu.
  5. In the **Data type** section, select the required type of key.

For example,
    - Email Address

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_Email.png)

**Figure 5: Tokenize email address**
    - Employer Identification Number (USA)

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_EIN.png)

**Figure 6: Tokenize employer identification number (USA)**
    - Military Officers Service Number (USA)

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_Military.png)

**Figure 7: Tokenize military officers service number (USA)**
    - Alphanumeric

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_Alphanumeric.png)

**Figure 8: Tokenize alphanumeric characters**
  6. In the **Key operations permitted** section, select the required operations to define the actions that can be performed with the cryptographic keys.
3. Click **GENERATE** to add the new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_Key_Created(1).png)

**Figure 9: Create a tokenization secret**

You now have the Unique Identifier (UUID) of the tokenization security object. The application uses this UUID to reference the secret and perform tokenization operations.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Tokenization_Secret_UUID.png)

**Figure 10: Key UUID to perform tokenization operations**

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

The Fortanix DSM supports cryptographic policies that can be set on accounts or groups to restrict what kind of keys can be created and the permitted operations. Policies are specified at the Account or Group level.

## Related

- [Azure Key Vault Group Setup](/fortanix-dsm-azure-key-vault-cdc-group-setup.md)
- [Fortanix DSM Key for Generating Certificates](/generating-certificates-using-a-fortanix-dsm-key.md)
- [Fortanix DSM with Microsoft PKI](/fortanix-dsm-with-microsoft-pki.md)
- [Fortanix DSM with Skyhigh Secure Web Gateway (SWG)](/fortanix-dsm-with-skyhigh-secure-web-gateway-swg.md)
- [Fortanix DSM with Microsoft SQL Server - Always Encrypted](/fortanix-dsm-with-microsoft-sql-server-always-encrypted.md)