Skip to main content
Service accounts are machine users for server-to-server communication. Unlike human users who authenticate with passkeys, service accounts use a keypair to sign API requests.

​
When to use a service account

Use a service account when you need to:
  • Call the DFNS API from your backend server
  • Run automated processes (scheduled transfers, batch operations)
  • Build applications that create wallets or manage users on behalf of your organization

​
Create the service account

1

Generate a keypair

Your service account needs a keypair to sign its API requests. Generate one using OpenSSL:
Keep the private key (service-account.pem) secure - you’ll need it to sign requests.
2

Create the service account in the dashboard

  1. Navigate to Settings > Developers > Service Accounts (direct link: https://app.dfns.io/settings/service-accounts)
  2. Click New Service Account
  3. Enter a name (e.g., “Backend Server” or “Trading Bot”)
  4. Paste the contents of your public key file (including the -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY----- lines)
  5. Click Create and 🔑 sign with your passkey
The public key field also accepts an OpenSSH-format public key (ssh-ed25519 AAAA..., ssh-rsa AAAA..., or ecdsa-sha2-nistp256/384/521 ... — the contents of a .pub file), in addition to the PEM/SPKI -----BEGIN PUBLIC KEY----- block. OpenSSH input is converted to PEM for you before the service account is created.
New service account form with a name and public key, Create button highlighted
3

Save the authentication token

After creation, you’ll see the service account token. Copy it immediately - it won’t be shown again.
Service account creation showing the masked authentication token with a Copy button
If you lose the token, you’ll need to create a new service account.
Store both the token and private key securely. DFNS recommends using a secrets manager like AWS Secrets Manager, HashiCorp Vault, or your cloud provider’s equivalent.
Service account tokens are valid for 2 years by default, which is also the maximum. To set a shorter lifetime, pass daysValid (or secondsValid) when creating the service account via the API; the dashboard always uses the default. When a token expires, requests fail with a 401, and you need to rotate the credential.
4

Review permissions

By default, a new service account has no permissions. You must explicitly assign a role with the permissions it needs:
  1. Navigate to Settings > Roles and create a new role with only the required permissions
  2. Go back to Settings > Developers > Service Accounts and click on your service account
  3. Assign the dedicated role
Common permission sets:See the full list of permissions for all available options.
You can also assign a permission at creation time by passing a permissionId in the Create Service Account API request body. The creating user must have the PermissionsAssign permission.

​
Service account limitations

Service accounts can perform most operations, but some actions require human interaction:
Service accounts can participate in policy approvals when explicitly enabled on the approval group. This feature requires activation by DFNS staff on your organization.

​
Using your service account

You now have everything needed to make API calls: See the TypeScript SDK service account example for a complete implementation.

Sign requests

How to sign API requests with your service account

Permissions reference

Full list of available permissions
Last modified on June 26, 2026