Skip to main content
POST
/
keys
curl --request POST \
  --url https://api.dfns.io/keys \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-DFNS-USERACTION: <api-key>' \
  --data '
{
  "scheme": "EdDSA",
  "curve": "ed25519"
}
'
{
  "id": "key-01snl-t56gb-j8tsok0vn802p80i",
  "scheme": "ECDSA",
  "curve": "ed25519",
  "publicKey": "<string>",
  "status": "Active",
  "custodial": true,
  "dateCreated": "2023-04-14T20:41:28.715Z",
  "masterKey": true,
  "derivedFrom": {
    "keyId": "key-01snl-t56gb-j8tsok0vn802p80i",
    "path": "<string>"
  },
  "name": "<string>",
  "imported": true,
  "exported": true,
  "dateExported": "2023-04-14T20:41:28.715Z",
  "dateDeleted": "2023-04-14T20:41:28.715Z"
}

​
Authentication

✅ Organization User (CustomerEmployee)
✅ Delegated User (EndUser)
✅ Service Account

​
Required Permissions

Keys:Create: Always required
Keys:Delegate: Required if delegateTo is specified.
Keys:ChildKeys:Create: Required if deriveFrom is specified.

Authorizations

​
Authorization
string
header
required

Bearer Token: Used to authenticate API requests. More details how to generate the token: Authentication flows

​
X-DFNS-USERACTION
string
header
required

User Action Signature: Used to sign the change-inducing API requests. More details how to generate the token: User Action Signing flows

Body

application/json
​
scheme
enum<string>
required

The cryptographic scheme for the key.

Available options:
ECDSA,
EdDSA,
Schnorr
​
curve
enum<string>
required

The elliptic curve for the key.

Available options:
ed25519,
secp256k1,
stark
​
name
string

Nickname for the key.

Maximum string length: 100
​
masterKey
boolean

Whether this key can be used as a master key for HD derivation.

​
deriveFrom
object

Options for hierarchical deterministic key derivation.

​
storeId
string

The key store to save the key to.

Required string length: 1 - 64
Example:

"store-425nf-ebf0a-qq22t6qra51tj8j0"

​
delegateTo
string

ID of the end user to delegate this key to.

Required string length: 1 - 64
Example:

"us-6b58p-r53sr-rlrd3l5cj3uc4ome"

​
delayDelegation
boolean

Whether to delay delegation until explicitly triggered.

Response

200 - application/json

Success

​
id
string
required

Unique identifier for the key.

Required string length: 1 - 64
Example:

"key-01snl-t56gb-j8tsok0vn802p80i"

​
scheme
enum<string>
required

The cryptographic scheme for the key.

Available options:
ECDSA,
EdDSA,
Schnorr
​
curve
enum<string>
required

The elliptic curve for the key.

Available options:
ed25519,
secp256k1,
stark
​
publicKey
string
required

Hex-encoded public key.

​
status
enum<string>
required

Current status of the key.

Available options:
Active,
Archived
​
custodial
boolean
required

Whether the key is custodial (owned by organization) or non-custodial (delegated to end user).

​
dateCreated
string<date-time>
required

ISO 8601 date (must be UTC). When the key was created.

Example:

"2023-04-14T20:41:28.715Z"

​
masterKey
boolean

Whether this key can be used as a master key for HD derivation.

​
derivedFrom
object

Derivation info if this key was derived from a master key.

​
name
string

Nickname for the key.

​
imported
boolean

Whether this key was imported.

​
exported
boolean

Whether this key has been exported.

​
dateExported
string<date-time>

ISO 8601 date (must be UTC). When the key was exported.

Example:

"2023-04-14T20:41:28.715Z"

​
dateDeleted
string<date-time>

ISO 8601 date (must be UTC). When the key was deleted.

Example:

"2023-04-14T20:41:28.715Z"