diff --git a/DigitalData.Core.Abstractions/Security/IAsymmetricKey.cs b/DigitalData.Core.Abstractions/Security/IAsymmetricKey.cs
index a18a617..f0a33c7 100644
--- a/DigitalData.Core.Abstractions/Security/IAsymmetricKey.cs
+++ b/DigitalData.Core.Abstractions/Security/IAsymmetricKey.cs
@@ -2,7 +2,7 @@
 {
     public interface IAsymmetricKey
     {
-        string Id { get; }
+        string? Id { get; }
 
         string Content { get; }
     }
diff --git a/DigitalData.Core.Security/Config/CryptoFactoryParams.cs b/DigitalData.Core.Security/Config/CryptoFactoryParams.cs
index 7f63cdd..6498c2d 100644
--- a/DigitalData.Core.Security/Config/CryptoFactoryParams.cs
+++ b/DigitalData.Core.Security/Config/CryptoFactoryParams.cs
@@ -50,14 +50,6 @@ namespace DigitalData.Core.Security.Config
             // init decryptors
             AfterCreate += () =>
             {
-                // set default parameters
-                var vaultDecryptor = VaultDecryptor is null ? Decryptors.FirstOrDefault() : VaultDecryptor;
-                if (vaultDecryptor is not null)
-                    vaultDecryptor.Id = "Vault";
-
-                foreach (var descriptor in TokenDescriptors)
-                    descriptor.IdSeparator = FileNameSeparator;
-
                 // Create root folder if it does not exist
                 if (!Directory.Exists(PemDirectory))
                     Directory.CreateDirectory(PemDirectory);
@@ -73,7 +65,17 @@ namespace DigitalData.Core.Security.Config
                     // set default path
                     if (privateKey.IsPemNull)
                     {
-                        var file_name_params = new List<object> { privateKey.Id, KeySizeInBits, DateTime.Now.ToTag(DateTagFormat) };
+                        // file name 
+                        var file_name_params = new List<object>();
+
+                        if (privateKey.Id is not null)
+                            file_name_params.Add(privateKey.Id);
+                        else if (privateKey is RSATokenDescriptor descriptor)
+                            file_name_params.Add(descriptor.Issuer);
+
+                        file_name_params.Add(KeySizeInBits);
+                        file_name_params.Add(DateTime.Now.ToTag(DateTagFormat));
+
                         if (privateKey.IsEncrypted)
                             file_name_params.Add(Secrets.Version);
 
diff --git a/DigitalData.Core.Security/RSAKey/RSAKeyBase.cs b/DigitalData.Core.Security/RSAKey/RSAKeyBase.cs
index 045b92e..a8f47f9 100644
--- a/DigitalData.Core.Security/RSAKey/RSAKeyBase.cs
+++ b/DigitalData.Core.Security/RSAKey/RSAKeyBase.cs
@@ -7,10 +7,10 @@ namespace DigitalData.Core.Security.RSAKey
     {
 #pragma warning disable CS8618 // Non-nullable field must contain a non-null value when exiting constructor. Consider declaring as nullable.
         public virtual string Content { get; init; }
-
-        public virtual string Id { get; internal set; }
 #pragma warning restore CS8618 // Non-nullable field must contain a non-null value when exiting constructor. Consider declaring as nullable.
 
+        public string? Id { get; init; }
+
         protected virtual RSA RSA { get; } = RSA.Create();
     }
 }
\ No newline at end of file
diff --git a/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs b/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
index 7fa5e75..5feed7c 100644
--- a/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
+++ b/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
@@ -8,12 +8,6 @@ namespace DigitalData.Core.Security.RSAKey
     /// </summary>
     public class RSATokenDescriptor : RSAPrivateKey, IAsymmetricTokenDescriptor
     {
-        internal string IdSeparator { get; set; } = "_-_";
-
-        private string? _id;
-
-        public override string Id { get => _id ?? $"{Issuer}{IdSeparator}{Audience}"; internal set => _id = value; }
-
         public string? ApiRoute { get; init; }
 
         #region SecurityTokenDescriptor Map