Skip to main content

​
Request signing

All state-changing requests made to the Dfns API must be cryptographically signed. The SDK handles this automatically when you configure a signer.
For a detailed explanation of request signing and User Action Challenges, see Signing requests.

​
Authentication tokens

Both DfnsClient and DfnsDelegatedClient require a valid auth_token. See Required headers for details on obtaining tokens.

​
KeySigner configuration

The KeySigner signs challenges using your private key. It supports Ed25519, ECDSA (secp256k1, P-256), and RSA keys. 
from dfns_sdk import KeySigner

signer = KeySigner(
    credential_id="cr-...",
    private_key=open("/path/to/private-key.pem").read(),
    app_origin="https://your-app.example.com"
)
ParameterDescription
credential_idID of the credential registered with your token. Find it in the Dfns Dashboard under Settings > Service Accounts or Settings > Personal Access Tokens .
private_keyPEM-formatted private key associated with the public key you registered when creating your PAT or Service Account.
app_originThe application origin (relying party) registered with your organization. Defaults to https://app.dfns.io.

​
Available API domains

Both clients provide typed access to all Dfns API domains:
DomainDescription
client.walletsWallet creation, listing, and management
client.keysKey management operations
client.policiesPolicy rules and approvals
client.permissionsAccess control and permissions
client.webhooksWebhook configuration
client.signersSigner management
client.stakingStaking operations
client.networksNetwork information
client.exchangesExchange integrations
client.fee_sponsorsFee sponsorship
client.swapsToken swap operations
client.agreementsAgreement management
client.allocationsAllocation management
client.authAuthentication helpers

​
Delegated signing

For implementing delegated signing flows (user passkeys or external KMS), see: