curl --request POST \
  --url https://api.dfns.io/keys/{keyId}/signatures \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "network": "BitcoinSignet",
  "kind": "Bip322",
  "message": "0x49206c6f76652044666e73"
}
'

{
  "id": "sig-4sfvl-f4iha-umighfi3hk4t54dr",
  "keyId": "key-01snl-t56gb-j8tsok0vn802p80i",
  "requester": {
    "userId": "us-6b58p-r53sr-rlrd3l5cj3uc4ome",
    "tokenId": "to-202a0-cdo33-o65mbt6q758lvvnt"
  },
  "requestBody": {
    "hash": "<string>",
    "taprootMerkleRoot": "<string>",
    "externalId": "<string>"
  },
  "dateRequested": "2023-04-14T20:41:28.715Z",
  "reason": "<string>",
  "signature": {
    "r": "<string>",
    "s": "<string>",
    "recid": 123,
    "encoded": "<string>"
  },
  "signatures": [
    {
      "r": "<string>",
      "s": "<string>",
      "recid": 123,
      "encoded": "<string>"
    }
  ],
  "signedData": "<string>",
  "txHash": "<string>",
  "fee": "<string>",
  "approvalId": "ap-2a9in-tt2a1-983lho480p35ejd0",
  "datePolicyResolved": "2023-04-14T20:41:28.715Z",
  "dateSigned": "2023-04-14T20:41:28.715Z",
  "dateConfirmed": "2023-04-14T20:41:28.715Z",
  "externalId": "<string>",
  "details": {}
}

Generate Signature

Request to generate a signature with the key. This process does not broadcast anything on-chain, this is just an off-chain signature request.

Dfns is compatible with any blockchain that uses a supported key format. If Dfns doesn’t officially integrate with a blockchain, you can use hash signing to generate the signatures to interact with the chain.

If you were using the deprecated POST /wallets/{walletId}/signatures endpoint, then you should now use this one. See the deprecation notice to get more information about how to change your code. TL,DR: from a wallet you can obtain the key as wallet.signingKey.id.

POST

keys

{keyId}

signatures

curl --request POST \
  --url https://api.dfns.io/keys/{keyId}/signatures \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "network": "BitcoinSignet",
  "kind": "Bip322",
  "message": "0x49206c6f76652044666e73"
}
'

{
  "id": "sig-4sfvl-f4iha-umighfi3hk4t54dr",
  "keyId": "key-01snl-t56gb-j8tsok0vn802p80i",
  "requester": {
    "userId": "us-6b58p-r53sr-rlrd3l5cj3uc4ome",
    "tokenId": "to-202a0-cdo33-o65mbt6q758lvvnt"
  },
  "requestBody": {
    "hash": "<string>",
    "taprootMerkleRoot": "<string>",
    "externalId": "<string>"
  },
  "dateRequested": "2023-04-14T20:41:28.715Z",
  "reason": "<string>",
  "signature": {
    "r": "<string>",
    "s": "<string>",
    "recid": 123,
    "encoded": "<string>"
  },
  "signatures": [
    {
      "r": "<string>",
      "s": "<string>",
      "recid": 123,
      "encoded": "<string>"
    }
  ],
  "signedData": "<string>",
  "txHash": "<string>",
  "fee": "<string>",
  "approvalId": "ap-2a9in-tt2a1-983lho480p35ejd0",
  "datePolicyResolved": "2023-04-14T20:41:28.715Z",
  "dateSigned": "2023-04-14T20:41:28.715Z",
  "dateConfirmed": "2023-04-14T20:41:28.715Z",
  "externalId": "<string>",
  "details": {}
}

Authentication

✅ Organization User (CustomerEmployee)
✅ Delegated User (EndUser)
✅ Service Account

Required Permissions

Keys:Signatures:Create: Always required.

Authorizations

Authorization

string

header

required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION

string

header

required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Path Parameters

keyId

string

required

The key to sign with.

Required string length: 1 - 64

Body

application/json

All cryptographic scheme support hash signing. Different blockchains will apply different hash functions to compute the hash.

kind

enum<string>

required

Available options:

Hash

hash

string

required

32-byte hash in hex encoded format.

Pattern: ^(0x)?[0-9a-fA-F]{64}$

taprootMerkleRoot

string

Required when signing with a Schnorr key. Specify the merkle root for tweaking the signing key, or the empty string "" to tweak with the default merkle root.

Pattern: ^(0x)?([0-9A-Fa-f]{64})?$

network

enum<string>

Available options:

Algorand,

AlgorandTestnet,

Aptos,

AptosTestnet,

ArbitrumOne,

ArbitrumSepolia,

ArcTestnet,

AvalancheC,

AvalancheCFuji,

BabylonGenesis,

BabylonTestnet5,

Base,

BaseSepolia,

Berachain,

BerachainBepolia,

Bitcoin,

BitcoinSignet,

BitcoinTestnet3,

BitcoinTestnet4,

BitcoinCash,

Bob,

BobSepolia,

Bsc,

BscTestnet,

Canton,

CantonTestnet,

Cardano,

CardanoPreprod,

Concordium,

ConcordiumTestnet,

Celo,

CeloAlfajores,

Codex,

CodexSepolia,

CosmosHub4,

CosmosIcsTestnet,

Dogecoin,

DogecoinTestnet,

Ethereum,

EthereumClassic,

EthereumClassicMordor,

EthereumSepolia,

EthereumHolesky,

EthereumHoodi,

FantomOpera,

FantomTestnet,

FlareC,

FlareCCoston2,

FlowEvm,

FlowEvmTestnet,

Hedera,

HederaTestnet,

Ink,

InkSepolia,

InternetComputer,

Ion,

IonTestnet,

Iota,

IotaTestnet,

Kaspa,

Kusama,

KusamaAssetHub,

Litecoin,

LitecoinTestnet,

Near,

NearTestnet,

Optimism,

OptimismSepolia,

Origyn,

Plasma,

PlasmaTestnet,

Plume,

PlumeSepolia,

Paseo,

PaseoAssetHub,

Polkadot,

PolkadotAssetHub,

Polygon,

PolygonAmoy,

Polymesh,

PolymeshTestnet,

Race,

RaceSepolia,

SeiAtlantic2,

SeiPacific1,

Solana,

SolanaDevnet,

Starknet,

StarknetSepolia,

Stellar,

StellarTestnet,

Sui,

SuiTestnet,

Tezos,

TezosGhostnet,

TezosShadownet,

Tempo,

TempoModerato,

Tsc,

TscTestnet1,

Ton,

TonTestnet,

Tron,

TronNile,

Westend,

WestendAssetHub,

Xdc,

XdcApothem,

XLayer,

XLayerSepolia,

XrpLedger,

XrpLedgerTestnet

blockchainKind

enum<string>

Available options:

Algorand,

Aptos,

Bitcoin,

BitcoinCash,

Canton,

Cardano,

Concordium,

Cosmos,

Evm,

Hedera,

Icp,

Iota,

Kaspa,

Near,

Polymesh,

Solana,

Starknet,

Stellar,

Substrate,

Sui,

Tezos,

Ton,

Tron,

Xrpl

externalId

string

A unique ID from your system. It can be leveraged to be used as an idempotency key (read more here).

Required string length: 1 - 50

Response

200 - application/json

Success

string

required

Signature id.

Required string length: 1 - 64

Pattern: ^sig-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"sig-4sfvl-f4iha-umighfi3hk4t54dr"

keyId

string

required

Key id.

Required string length: 1 - 64

Pattern: ^key-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"key-01snl-t56gb-j8tsok0vn802p80i"

requester

object

required

The user who initiated the request.

Show child attributes

requestBody

Hash · object

required

All cryptographic scheme support hash signing. Different blockchains will apply different hash functions to compute the hash.

Show child attributes

status

enum<string>

required

Available options:

Pending,

Executing,

Signed,

Confirmed,

Failed,

Rejected

dateRequested

string<date-time>

required

ISO 8601 date (must be UTC). When the signature was requested.

Example:

"2023-04-14T20:41:28.715Z"

reason

string

signature

object

Show child attributes

signatures

object[]

Show child attributes

signedData

string

network

enum<string>

Available options:

Algorand,

AlgorandTestnet,

Aptos,

AptosTestnet,

ArbitrumOne,

ArbitrumSepolia,

ArcTestnet,

AvalancheC,

AvalancheCFuji,

BabylonGenesis,

BabylonTestnet5,

Base,

BaseSepolia,

Berachain,

BerachainBepolia,

Bitcoin,

BitcoinSignet,

BitcoinTestnet3,

BitcoinTestnet4,

BitcoinCash,

Bob,

BobSepolia,

Bsc,

BscTestnet,

Canton,

CantonTestnet,

Cardano,

CardanoPreprod,

Concordium,

ConcordiumTestnet,

Celo,

CeloAlfajores,

Codex,

CodexSepolia,

CosmosHub4,

CosmosIcsTestnet,

Dogecoin,

DogecoinTestnet,

Ethereum,

EthereumClassic,

EthereumClassicMordor,

EthereumSepolia,

EthereumHolesky,

EthereumHoodi,

FantomOpera,

FantomTestnet,

FlareC,

FlareCCoston2,

FlowEvm,

FlowEvmTestnet,

Hedera,

HederaTestnet,

Ink,

InkSepolia,

InternetComputer,

Ion,

IonTestnet,

Iota,

IotaTestnet,

Kaspa,

Kusama,

KusamaAssetHub,

Litecoin,

LitecoinTestnet,

Near,

NearTestnet,

Optimism,

OptimismSepolia,

Origyn,

Plasma,

PlasmaTestnet,

Plume,

PlumeSepolia,

Paseo,

PaseoAssetHub,

Polkadot,

PolkadotAssetHub,

Polygon,

PolygonAmoy,

Polymesh,

PolymeshTestnet,

Race,

RaceSepolia,

SeiAtlantic2,

SeiPacific1,

Solana,

SolanaDevnet,

Starknet,

StarknetSepolia,

Stellar,

StellarTestnet,

Sui,

SuiTestnet,

Tezos,

TezosGhostnet,

TezosShadownet,

Tempo,

TempoModerato,

Tsc,

TscTestnet1,

Ton,

TonTestnet,

Tron,

TronNile,

Westend,

WestendAssetHub,

Xdc,

XdcApothem,

XLayer,

XLayerSepolia,

XrpLedger,

XrpLedgerTestnet

txHash

string

fee

string

approvalId

string

Required string length: 1 - 64

Pattern: ^ap-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"ap-2a9in-tt2a1-983lho480p35ejd0"

datePolicyResolved

string<date-time>

ISO 8601 date (must be UTC). When the signature was approved by policy reviewers.

Example:

"2023-04-14T20:41:28.715Z"

dateSigned

string<date-time>

ISO 8601 date (must be UTC). When the signature was signed.

Example:

"2023-04-14T20:41:28.715Z"

dateConfirmed

string<date-time>

ISO 8601 date (must be UTC). When the signature was confirmed on chain.

Example:

"2023-04-14T20:41:28.715Z"

externalId

string

details

object

Structured representation of the data used to construct the signature (e.g. nonce, gas parameters). Shape is blockchain specific.

Show child attributes

Last modified on June 5, 2026

Sign

List Signatures

⌘I

​Authentication

​Required Permissions

Authorizations

Path Parameters

Body

Response

Authentication

Required Permissions