User Action Signing

const signChallenge = async (challenge: UserActionSignatureChallenge) : Promise<SignedChallenge> => {

  // The data being signed includes information that is important for validating the request originated from a valid location.
  const clientData: Buffer = Buffer.from(
    JSON.stringify({
      type: 'key.get',
      challenge: challenge.challenge,
      origin: origin,
      crossOrigin: false,
    } as ClientData)
  )

  // Signing can be done locally or by calling an external signer (like AWS KMS).
  const signature = crypto.sign(
    undefined,
    clientData,
    apiKeyPrivateKey
  )

  // Pass back the signature, and the data that was signed so both can be parsed and validated properly.
  return {
    clientData: clientData.toString('base64url'),
    credId: challenge.allowCredentials.key[0].id,
    signature: signature.toString('base64url'),
  }
}

import json
import base64
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding, ec

def sign_challenge(challenge: dict, private_key_pem: str, origin: str) -> dict:
    # The data being signed includes information for validating the request origin
    client_data = json.dumps({
        "type": "key.get",
        "challenge": challenge["challenge"],
        "origin": origin,
        "crossOrigin": False,
    }, separators=(',', ':')).encode()

    # Load the private key
    private_key = serialization.load_pem_private_key(
        private_key_pem.encode(),
        password=None
    )

    # Sign with the appropriate algorithm based on key type
    if isinstance(private_key, ec.EllipticCurvePrivateKey):
        signature = private_key.sign(client_data, ec.ECDSA(hashes.SHA256()))
    else:
        signature = private_key.sign(client_data)

    # Return base64url-encoded values
    def to_base64url(data: bytes) -> str:
        return base64.urlsafe_b64encode(data).rstrip(b'=').decode()

    return {
        "clientData": to_base64url(client_data),
        "credId": challenge["allowCredentials"]["key"][0]["id"],
        "signature": to_base64url(signature),
    }

from dfns_sdk import DfnsClient, DfnsClientConfig, KeySigner

# Configure the signer once - signing is then automatic
signer = KeySigner(
    credential_id="cr-...",
    private_key=open("/path/to/private-key.pem").read(),
    app_origin="https://your-app.example.com"
)

config = DfnsClientConfig(auth_token="...", signer=signer)

# Signing happens automatically for state-changing operations
with DfnsClient(config) as client:
    wallet = client.wallets.create_wallet({"network": "EthereumSepolia"})

import (
    dfns "github.com/dfns/dfns-sdk-go/v2"
    "github.com/dfns/dfns-sdk-go/v2/signer"
    "github.com/dfns/dfns-sdk-go/v2/wallets"
)

// Configure the signer once - signing is then automatic
keySigner, _ := signer.NewKeySigner("cr-...", string(privateKeyPEM))

client, _ := dfns.NewClient(dfns.Options{
    AuthToken: "...",
    Signer:    keySigner,
})

// Signing happens automatically for state-changing operations
wallet, _ := client.Wallets.CreateWallet(ctx, wallets.CreateWalletRequest{
    Network: "EthereumSepolia",
})

import co.dfns.sdk.*;
import co.dfns.sdk.auth.*;
import co.dfns.sdk.wallets.model.*;

// Configure the signer once - signing is then automatic
Signer signer = KeySigner.fromEd25519PrivateKey("cr-...", privateKeyBytes);

DfnsClientConfig config = DfnsClientConfig.builder()
    .authToken("...")
    .signer(signer)
    .build();

// Signing happens automatically for state-changing operations
try (DfnsClient client = new DfnsClient(config)) {
    Wallet wallet = client.wallets.createWallet(
        new CreateWalletRequest(Network.EthereumSepolia, null, null, null, null, null, null)
    );
}