Delegated Login

curl --request POST \
  --url https://api.dfns.io/auth/login/delegated \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "username": "<string>"
}
'

import requests

url = "https://api.dfns.io/auth/login/delegated"

payload = { "username": "<string>" }
headers = {
    "Authorization": "Bearer <token>",
    "X-DFNS-USERACTION": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-DFNS-USERACTION': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({username: '<string>'})
};

fetch('https://api.dfns.io/auth/login/delegated', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/auth/login/delegated",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'username' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-DFNS-USERACTION: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/auth/login/delegated"

	payload := strings.NewReader("{\n  \"username\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-DFNS-USERACTION", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.dfns.io/auth/login/delegated")
  .header("Authorization", "Bearer <token>")
  .header("X-DFNS-USERACTION", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"username\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/auth/login/delegated")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-DFNS-USERACTION"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"username\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "token": "<string>",
  "expiry": 123,
  "identity": {
    "userId": "<string>",
    "username": "<string>",
    "orgId": "<string>",
    "tenantId": "<string>"
  }
}

Delegated Login

Only a Service Account can use this endpoint.

Logs an end user (EndUser) into an organization without the user’s credentials. It cannot log in employees.

If you want to use your own authentication system, while still using Delegated Signing, you can use this endpoint to authenticate a user without needing the user’s credentials.

The service account needs the Auth:Delegated:Login permission, and the request must be signed with a user action signature (X-DFNS-USERACTION header) from the service account’s key. The DFNS SDKs do this for you when the client is configured with the service account’s signer.

The user authentication token can be used for read operations within the Dfns API, however, write operations will still require the user to sign the action.

POST

auth

delegated

Delegated Login

curl --request POST \
  --url https://api.dfns.io/auth/login/delegated \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "username": "<string>"
}
'

import requests

url = "https://api.dfns.io/auth/login/delegated"

payload = { "username": "<string>" }
headers = {
    "Authorization": "Bearer <token>",
    "X-DFNS-USERACTION": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-DFNS-USERACTION': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({username: '<string>'})
};

fetch('https://api.dfns.io/auth/login/delegated', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/auth/login/delegated",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'username' => '<string>'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-DFNS-USERACTION: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/auth/login/delegated"

	payload := strings.NewReader("{\n  \"username\": \"<string>\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-DFNS-USERACTION", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.dfns.io/auth/login/delegated")
  .header("Authorization", "Bearer <token>")
  .header("X-DFNS-USERACTION", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"username\": \"<string>\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/auth/login/delegated")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-DFNS-USERACTION"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"username\": \"<string>\"\n}"

response = http.request(request)
puts response.read_body

{
  "token": "<string>",
  "expiry": 123,
  "identity": {
    "userId": "<string>",
    "username": "<string>",
    "orgId": "<string>",
    "tenantId": "<string>"
  }
}

Authentication

❌ Tenant User (TenantUser)
❌ Organization User (CustomerEmployee)
❌ End User (EndUser)
✅ Service Account

Required Permissions

Auth:Delegated:Login: Always required.

Authorizations

Authorization

string

header

required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION

string

header

required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Body

application/json

username

string

required

Username/identifier of the user to log in.

Response

200 - application/json

Success

token

string

required

Authentication token issued to the user.

expiry

number

Token expiration time in epoch milliseconds.

identity

object

Decoded identity for the issued token. Populated for flows whose token is not a Dfns-minted JWT (e.g. OIDC passthrough) so clients can skip JWT decoding; absent on flows where the token's claims carry the same fields.

Show child attributes

API Authorization

Identity & Access Management

Wallets & Transactions

Management

Webhooks

Delegated Login

Authentication

Required Permissions

Authorizations

Body

Response

​Authentication

​Required Permissions

Authorizations

Body

Response

Authentication

Required Permissions