Skip to main content
To use Dfns API endpoints, you will generally need to:

​
1. Get an authentication token

Login and obtain an Authentication tokens (also referred to as token) to present when calling our API.
HeaderDescription
Authorization: Bearer <token>Authentication token
(see Authentication flows)
To get a token, you can either:
  • as a User (human 👨)
    • Follow the Login flow. You’ll get a authentication token at the end of this flow, which expires after a relatively short period of time.
    • Create a Personal Access Token (PAT) ⚠️1, which is a long-lived authentication token for the User, and that you can use as an authentication token directly.
  • as a Service Account (machine 🤖)
    • Create a Service Account Token ⚠️1, which is a long-lived authentication token for the Service Account, and that you can use as an authentication token directly.
Note: while registering a new user (see Registration flows), the initial step will get you a temporary registration token (example) that you should use as a Bearer token in the Authorization header for the next step of the registration (example).

​
2. Sign API requests (User Action Signing)

Sign a User Action Challenge using a cryptographic key that you own (referred to Credential Key or just Credentials). This is only required for actions which mutate state (non-readonly API calls). We call that process: “User Action Signing”.
HeaderDescription
X-DFNS-USERACTION: <user-action-signature>One time signature
(see User Action Signing flows)
To obtain that signature, you need to follow the User Action Signing flows:
  1. You tell Dfns “I want to perform this exact request”
  2. Dfns sends you back a challenge to be signed with your Credential.
  3. You sign the challenge with your Credentials, and send it to Dfns.
  4. Dfns gives you back a “user action signature”, which you’ll need include in the headers when you perform the actual request (X-DFNS-USERACTION header)
The credential — essentially being a cryptographic key — you’ll need to use to sign the challenge will depend on who is calling the api (User / Service Account), see more about that on the dedicated page.

Footnotes

  1. ⚠️ Once generated, Dfns system do not keep a trace of your Service Account Token or your Personal Access Token, only you will hold on to those. If you lose them, you’ll just need to create a new one. ↩ ↩2
⌘I