Import Key

curl --request POST \
  --url https://api.dfns.io/keys/import \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "name": "my-imported-key",
  "curve": "secp256k1",
  "protocol": "CGGMP21",
  "minSigners": 2,
  "encryptedKeyShares": [
    {
      "signerId": "signer-1",
      "encryptedKeyShare": "<base64-encrypted-share>"
    },
    {
      "signerId": "signer-2",
      "encryptedKeyShare": "<base64-encrypted-share>"
    },
    {
      "signerId": "signer-3",
      "encryptedKeyShare": "<base64-encrypted-share>"
    }
  ]
}
'

import requests

url = "https://api.dfns.io/keys/import"

payload = {
    "name": "my-imported-key",
    "curve": "secp256k1",
    "protocol": "CGGMP21",
    "minSigners": 2,
    "encryptedKeyShares": [
        {
            "signerId": "signer-1",
            "encryptedKeyShare": "<base64-encrypted-share>"
        },
        {
            "signerId": "signer-2",
            "encryptedKeyShare": "<base64-encrypted-share>"
        },
        {
            "signerId": "signer-3",
            "encryptedKeyShare": "<base64-encrypted-share>"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "X-DFNS-USERACTION": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-DFNS-USERACTION': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'my-imported-key',
    curve: 'secp256k1',
    protocol: 'CGGMP21',
    minSigners: 2,
    encryptedKeyShares: [
      {signerId: 'signer-1', encryptedKeyShare: '<base64-encrypted-share>'},
      {signerId: 'signer-2', encryptedKeyShare: '<base64-encrypted-share>'},
      {signerId: 'signer-3', encryptedKeyShare: '<base64-encrypted-share>'}
    ]
  })
};

fetch('https://api.dfns.io/keys/import', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/keys/import",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'my-imported-key',
    'curve' => 'secp256k1',
    'protocol' => 'CGGMP21',
    'minSigners' => 2,
    'encryptedKeyShares' => [
        [
                'signerId' => 'signer-1',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ],
        [
                'signerId' => 'signer-2',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ],
        [
                'signerId' => 'signer-3',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-DFNS-USERACTION: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/keys/import"

	payload := strings.NewReader("{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-DFNS-USERACTION", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.dfns.io/keys/import")
  .header("Authorization", "Bearer <token>")
  .header("X-DFNS-USERACTION", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/keys/import")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-DFNS-USERACTION"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "key-01snl-t56gb-j8tsok0vn802p80i",
  "scheme": "ECDSA",
  "curve": "ed25519",
  "publicKey": "<string>",
  "status": "Active",
  "custodial": true,
  "dateCreated": "2023-04-14T20:41:28.715Z",
  "masterKey": true,
  "derivedFrom": {
    "keyId": "key-01snl-t56gb-j8tsok0vn802p80i",
    "path": "<string>"
  },
  "name": "<string>",
  "imported": true,
  "exported": true,
  "dateExported": "2023-04-14T20:41:28.715Z",
  "dateDeleted": "2023-04-14T20:41:28.715Z"
}

Import Key

Dfns secures private keys by generating them as MPC key shares in our decentralized key management network. This happens by default when you create a key or wallet.

In some circumstances, however, you may need to import an existing private key into Dfns infrastructure, instead of creating a brand new wallet with Dfns and transfer funds to it. As an example, you might want to keep an existing wallet if its address is tied to a smart contract which you don’t want to re-deploy.

In such a case, Dfns exposes this key import API endpoint, which can be used in conjunction with our import SDK. Note this is intended to be used only to migrate wallets when first onboarding onto the Dfns platform.

Dfns can not guarantee the security of imported wallets, as we have no way to control who had access to the private key prior to import. For this reason, this feature is restricted to Enterprise customers who have signed a contractual addendum limiting our liability for imported keys. Please contact your sales representative for more information.

POST

keys

import

Import Key

curl --request POST \
  --url https://api.dfns.io/keys/import \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "name": "my-imported-key",
  "curve": "secp256k1",
  "protocol": "CGGMP21",
  "minSigners": 2,
  "encryptedKeyShares": [
    {
      "signerId": "signer-1",
      "encryptedKeyShare": "<base64-encrypted-share>"
    },
    {
      "signerId": "signer-2",
      "encryptedKeyShare": "<base64-encrypted-share>"
    },
    {
      "signerId": "signer-3",
      "encryptedKeyShare": "<base64-encrypted-share>"
    }
  ]
}
'

import requests

url = "https://api.dfns.io/keys/import"

payload = {
    "name": "my-imported-key",
    "curve": "secp256k1",
    "protocol": "CGGMP21",
    "minSigners": 2,
    "encryptedKeyShares": [
        {
            "signerId": "signer-1",
            "encryptedKeyShare": "<base64-encrypted-share>"
        },
        {
            "signerId": "signer-2",
            "encryptedKeyShare": "<base64-encrypted-share>"
        },
        {
            "signerId": "signer-3",
            "encryptedKeyShare": "<base64-encrypted-share>"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "X-DFNS-USERACTION": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-DFNS-USERACTION': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    name: 'my-imported-key',
    curve: 'secp256k1',
    protocol: 'CGGMP21',
    minSigners: 2,
    encryptedKeyShares: [
      {signerId: 'signer-1', encryptedKeyShare: '<base64-encrypted-share>'},
      {signerId: 'signer-2', encryptedKeyShare: '<base64-encrypted-share>'},
      {signerId: 'signer-3', encryptedKeyShare: '<base64-encrypted-share>'}
    ]
  })
};

fetch('https://api.dfns.io/keys/import', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.dfns.io/keys/import",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'my-imported-key',
    'curve' => 'secp256k1',
    'protocol' => 'CGGMP21',
    'minSigners' => 2,
    'encryptedKeyShares' => [
        [
                'signerId' => 'signer-1',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ],
        [
                'signerId' => 'signer-2',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ],
        [
                'signerId' => 'signer-3',
                'encryptedKeyShare' => '<base64-encrypted-share>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-DFNS-USERACTION: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.dfns.io/keys/import"

	payload := strings.NewReader("{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-DFNS-USERACTION", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.dfns.io/keys/import")
  .header("Authorization", "Bearer <token>")
  .header("X-DFNS-USERACTION", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.dfns.io/keys/import")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-DFNS-USERACTION"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"my-imported-key\",\n  \"curve\": \"secp256k1\",\n  \"protocol\": \"CGGMP21\",\n  \"minSigners\": 2,\n  \"encryptedKeyShares\": [\n    {\n      \"signerId\": \"signer-1\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-2\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    },\n    {\n      \"signerId\": \"signer-3\",\n      \"encryptedKeyShare\": \"<base64-encrypted-share>\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "key-01snl-t56gb-j8tsok0vn802p80i",
  "scheme": "ECDSA",
  "curve": "ed25519",
  "publicKey": "<string>",
  "status": "Active",
  "custodial": true,
  "dateCreated": "2023-04-14T20:41:28.715Z",
  "masterKey": true,
  "derivedFrom": {
    "keyId": "key-01snl-t56gb-j8tsok0vn802p80i",
    "path": "<string>"
  },
  "name": "<string>",
  "imported": true,
  "exported": true,
  "dateExported": "2023-04-14T20:41:28.715Z",
  "dateDeleted": "2023-04-14T20:41:28.715Z"
}

Authentication

✅ Organization User (CustomerEmployee)
✅ Delegated User (EndUser)
✅ Service Account

Required Permissions

Keys:Import: Always required.

Authorizations

Authorization

string

header

required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

X-DFNS-USERACTION

string

header

required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Body

application/json

curve

enum<string>

required

The elliptic curve of the private key being imported.

Available options:

ed25519,

secp256k1,

stark

protocol

required

The MPC protocol the key shares are formatted for.

Available options:

CGGMP24,

FROST,

FROST_BITCOIN,

GLOW20_DH,

KU23

minSigners

integer

required

The TSS threshold: the minimum number of key shares required to sign.

encryptedKeyShares

object[]

required

One key share per signer, each encrypted to that signer.

Minimum array length: 1

Show child attributes

name

string

Nickname for the imported key.

Maximum string length: 100

masterKey

boolean

Specify to create an extended master key for HD derivation.

Response

200 - application/json

Success

string

required

Unique identifier for the key.

Required string length: 1 - 64

Pattern: ^key-[a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{14,16}$

Example:

"key-01snl-t56gb-j8tsok0vn802p80i"

scheme

enum<string>

required

The cryptographic scheme for the key.

Available options:

ECDSA,

EdDSA,

Schnorr

curve

enum<string>

required

The elliptic curve for the key.

Available options:

ed25519,

secp256k1,

stark

publicKey

string

required

Hex-encoded public key.

status

enum<string>

required

Current status of the key.

Available options:

Active,

Archived

custodial

boolean

required

Whether the key is custodial (owned by organization) or non-custodial (delegated to end user).

dateCreated

string<date-time>

required

ISO 8601 date (must be UTC). When the key was created.

Example:

"2023-04-14T20:41:28.715Z"

masterKey

boolean

Whether this key can be used as a master key for HD derivation.

derivedFrom

object

Derivation info if this key was derived from a master key.

Show child attributes

name

string

Nickname for the key.

imported

boolean

Whether this key was imported.

exported

boolean

Whether this key has been exported.

dateExported

string<date-time>

ISO 8601 date (must be UTC). When the key was exported.

Example:

"2023-04-14T20:41:28.715Z"

dateDeleted

string<date-time>

ISO 8601 date (must be UTC). When the key was deleted.

Example:

"2023-04-14T20:41:28.715Z"

Last modified on August 27, 2026

API Authorization

Identity & Access Management

Wallets & Transactions

Management

Webhooks

Import Key

Authentication

Required Permissions

Authorizations

Body

Response

​Authentication

​Required Permissions

Authorizations

Body

Response

Authentication

Required Permissions