> ## Documentation Index > Fetch the complete documentation index at: https://docs.dfns.co/llms.txt > Use this file to discover all available pages before exploring further. # Export Key > Dfns secures private keys by generating them as MPC key shares in our decentralized key management network. Our goal is to eliminate all single points of failure (SPOFs) associated with blockchain private keys. In certain circumstances, however, customers require Dfns to export a private key. In this case, Dfns exposes the following endpoint which can be used in conjunction with our [export SDK](https://github.com/dfns/dfns-sdk-ts/tree/m/examples/sdk/export-wallet). Each signer returns its key share encrypted to an encryption key you provide; the full private key is reconstituted client-side and is never assembled on Dfns servers. Once a key is exported and reconstituted, it becomes a single point of failure that Dfns can no longer protect: anyone who obtains it controls the wallet and its assets, and Dfns can not guarantee the security of transactions signed with it. You are solely responsible for the exported key's security — its storage, encryption, access controls, and protection against theft or misuse. Key export is not enabled by default; contact our support team to have it activated for your organization. #### Authentication ✅ Organization User (`CustomerEmployee`)\ ✅ Delegated User (`EndUser`)\ ✅ Service Account #### Required Permissions `Keys:Export`: Always required. ## OpenAPI ````yaml /openapi.yaml post /keys/{keyId}/export openapi: 3.1.0 info: version: 2.0.211 title: Dfns servers: - url: https://api.dfns.io description: Default - Europe - url: https://api.uae.dfns.io description: UAE - url: https://api.dfns.ninja description: Staging security: [] paths: /keys/{keyId}/export: post: tags: - Keys summary: Export Key description: >- Dfns secures private keys by generating them as MPC key shares in our decentralized key management network. Our goal is to eliminate all single points of failure (SPOFs) associated with blockchain private keys. In certain circumstances, however, customers require Dfns to export a private key. In this case, Dfns exposes the following endpoint which can be used in conjunction with our [export SDK](https://github.com/dfns/dfns-sdk-ts/tree/m/examples/sdk/export-wallet). Each signer returns its key share encrypted to an encryption key you provide; the full private key is reconstituted client-side and is never assembled on Dfns servers. Once a key is exported and reconstituted, it becomes a single point of failure that Dfns can no longer protect: anyone who obtains it controls the wallet and its assets, and Dfns can not guarantee the security of transactions signed with it. You are solely responsible for the exported key's security — its storage, encryption, access controls, and protection against theft or misuse. Key export is not enabled by default; contact our support team to have it activated for your organization. operationId: exportKey parameters: - schema: type: string minLength: 1 maxLength: 64 description: The key to export. required: true description: The key to export. name: keyId in: path requestBody: required: true content: application/json: schema: type: object properties: encryptionKey: type: string minLength: 1 description: >- The public encryption key the signers should encrypt their key shares to. supportedSchemes: type: array items: type: object properties: protocol: anyOf: - type: string enum: - CGGMP24 - FROST - FROST_BITCOIN - GLOW20_DH - KU23 - type: string enum: - CGGMP21 description: An MPC protocol the client supports. curve: type: string enum: - ed25519 - secp256k1 - stark description: An elliptic curve the client supports. required: - protocol - curve additionalProperties: false description: >- The protocol/curve combinations the client is able to reconstruct the key from. required: - encryptionKey - supportedSchemes additionalProperties: false examples: Export: value: encryptionKey: supportedSchemes: - protocol: CGGMP21 curve: secp256k1 responses: '200': description: Success content: application/json: schema: type: object properties: publicKey: type: string description: Hex-encoded public key of the exported key. protocol: anyOf: - type: string enum: - CGGMP24 - FROST - FROST_BITCOIN - GLOW20_DH - KU23 - type: string enum: - CGGMP21 description: The MPC protocol the key shares are for. curve: type: string enum: - ed25519 - secp256k1 - stark description: The elliptic curve of the exported key. minSigners: type: number description: The TSS threshold of the wallet private signing key shares encryptedKeyShares: type: array items: type: object properties: signerId: type: string description: >- Base64-encoded ID of the signer exported the encrypted keyshare encryptedKeyShare: type: string description: Base64-encoded keyshare required: - signerId - encryptedKeyShare description: >- Keyshares of the exported wallet. They are encrypted with the provided encryption key. The exported private key is re-constructed from these keyshares. required: - publicKey - protocol - curve - minSigners - encryptedKeyShares security: - authenticationToken: [] userActionSignature: [] components: securitySchemes: authenticationToken: type: http scheme: bearer bearerFormat: JWT description: >- **Bearer Token:** Used to authenticate API requests. More details how to generate the token: [Authentication flows](https://docs.dfns.co/api-reference/auth/login-flows) userActionSignature: type: apiKey in: header name: X-DFNS-USERACTION description: >- **User Action Signature:** Used to sign the change-inducing API requests. More details how to generate the token: [User Action Signing flows](https://docs.dfns.co/api-reference/auth/signing-flows) ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.