Skip to main content
DFNS secures private keys by generating them as MPC key shares in our decentralized key management network. This happens by default when you create a wallet. In some circumstances, you may need to import an existing private key or export a key from DFNS.
Import is not the same as activate. Import brings an existing external private key into DFNS MPC (this page). Activate wallet is an unrelated blockchain-level step that deploys or registers a DFNS-created account on-chain for networks that require it (e.g., Starknet, Canton, Concordium). You do not import a wallet to activate it, and you do not activate an imported key.

​
Import

We recommend creating new wallets and transferring funds instead of importing keys. Imported keys are inherently less secure because they existed in complete form before import. You cannot verify how the key was stored, handled, or who may have had access to it. Keys generated natively by DFNS MPC have never existed as a complete key and provide stronger security guarantees.
DFNS uses MPC (Multi-Party Computation) to secure keys. When you import a key, the SDK processes it entirely on your machine using WebAssembly:
  1. Fetch signers - The SDK retrieves DFNS signer nodes and their public keys
  2. Split locally - Your private key is split into shares using threshold cryptography
  3. Encrypt for signers - Each share is encrypted with the corresponding signer’s public key
  4. Transmit shares - Only encrypted shares are sent to DFNS
The complete private key never leaves your machine and never exists on DFNS servers. Once imported, the key operates like any DFNS-native key with full MPC security for signing operations.

Step-by-step guide

For detailed import instructions including vendor-specific migration steps, see the developer guide.

​
After importing a key

Once you’ve imported a key, you can:
  • Create wallets from it: Use Create Wallet with signingKey.id to create wallets on specific networks
  • Sign directly: Use the Signing API for raw signatures
  • Multi-chain usage: The same key can be used across compatible networks (e.g., all EVM chains share the same address)

​
When to import vs create new

Import makes sense when:
  • The wallet address is tied to a smart contract you can’t redeploy
  • You have regulatory requirements to maintain specific addresses
  • The address has non-transferable assets (certain NFTs, protocol permissions)
Create new keys instead when:
  • Starting fresh with no legacy requirements
  • High-value production wallets
  • You can move assets from old wallets

​
Export

Export a key from DFNS to use it outside the platform — either to migrate it to another provider, or to hold an independent backup for disaster recovery. The ceremony below is the same for both.
DFNS cannot guarantee the security of transactions signed with exported keys. Once a key leaves DFNS, its security is entirely your responsibility.
The export process is the reverse of import. The SDK runs entirely on your machine using WebAssembly:
  1. Generate a keypair - You provide a public key that the MPC signers will use to encrypt their shares
  2. Encrypted download - Each signer encrypts its key share with your public key and sends it to your machine
  3. Local reconstitution - The SDK decrypts the shares and reconstitutes the full private key locally
The complete private key only exists on your machine at the end of this process. It is never assembled on DFNS servers.
The encryption in step 1-2 protects the shares in transit. The reconstituted key itself is not encrypted. If you need to store it, you are responsible for encrypting it at rest.
See the export SDK example for implementation details.

Step-by-step guide

Export a key and confirm it works, including an offline signing test.

Wallets & Keys

Understanding the difference between keys and wallets

SDK examples

Import SDK implementation examples
Last modified on August 7, 2026