Skip to main content
POST
Derive Key

Authentication

✅ Organization User (CustomerEmployee)
✅ Delegated User (EndUser)
✅ Service Account

Required Permissions

Keys:Vrf:Derive: Always required.

Authorizations

Authorization
string
header
required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION
string
header
required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Path Parameters

keyId
string
required

The Diffie-Hellman key to derive from. Must be a key created with scheme=DH.

Required string length: 1 - 64

Body

application/json
domain
string
required

Hex-encoded domain separation tag used as an input to the derivation.

Pattern: ^(0x)?([0-9a-fA-F][0-9a-fA-F])*$
seed
string
required

Hex-encoded seed value to derive from. The seed does not need to be secret.

Pattern: ^(0x)?([0-9a-fA-F][0-9a-fA-F])*$

Response

200 - application/json

Success

output
string
required

Hex-encoded derived output. Deterministic for a given key, domain and seed.

Last modified on August 27, 2026