Python SDK

The Python SDK is designed for server-side/backend applications. It handles request signing and provides typed access to the DFNS API. You can find the repository on GitHub.

Installation

pip install dfns_sdk

Quick start

1. Read-only operations

For read-only operations (listing wallets, fetching balances, etc.), you only need an auth token:

from dfns_sdk import DfnsClient, DfnsClientConfig

config = DfnsClientConfig(auth_token="your-auth-token")

with DfnsClient(config) as client:
    wallets = client.wallets.list_wallets()
    for wallet in wallets["items"]:
        print(f"{wallet['id']}: {wallet['network']} {wallet['address']}")

For a quick test you can get your login token (short-lived) from the DFNS Dashboard under Settings > Personal Access Tokens.

2. Signing requests

State-changing operations (creating wallets, signing transactions, etc.) require cryptographic request signing. Choose your approach based on where the private key lives:

Direct signing
Delegated signing

Use DfnsClient with a KeySigner when your backend has direct access to the private key (e.g., stored in a file or environment variable).This is ideal for service accounts where the private key is securely stored on your server.

from dfns_sdk import DfnsClient, DfnsClientConfig, KeySigner

signer = KeySigner(
    credential_id="cr-...",
    private_key=open("/path/to/private-key.pem").read(),
    app_origin="https://your-app.example.com"
)

config = DfnsClientConfig(
    auth_token="your-auth-token",
    signer=signer
)

with DfnsClient(config) as client:
    wallet = client.wallets.create_wallet({"network": "EthereumSepolia"})
    print(f"Created wallet: {wallet['id']}")

Use DfnsDelegatedClient when the private key is not directly accessible to your backend:

User passkeys: Users sign with their own device (WebAuthn/biometrics)
External KMS: Private key stored in AWS KMS, HashiCorp Vault, etc.

The flow splits into init and complete phases:

from dfns_sdk import DfnsDelegatedClient, DfnsDelegatedClientConfig

config = DfnsDelegatedClientConfig(auth_token="user-auth-token")

with DfnsDelegatedClient(config) as client:
    # Step 1: Initialize and get a challenge
    challenge = client.wallets.create_wallet_init(body={"network": "EthereumSepolia"})

    # Step 2: Send challenge to be signed externally
    # - For passkeys: send to user's frontend for WebAuthn signing
    # - For KMS: send to your KMS to sign
    # signed_challenge = ... (received from external signer)

    # Step 3: Complete with the signed challenge
    wallet = client.wallets.create_wallet_complete(
        body={"network": "EthereumSepolia"},
        signed_challenge={
            "challengeIdentifier": challenge["challengeIdentifier"],
            "firstFactor": signed_challenge
        }
    )
    print(f"Created wallet: {wallet['id']}")

Next steps

Create a service account for server-to-server authentication with long-lived tokens
Development guide for detailed request signing architecture
Delegated wallets for implementing user passkey flows

Backend SDKs

Frontend SDKs

Installation

Quick start

1. Read-only operations

2. Signing requests

Next steps

​Installation

​Quick start

​1. Read-only operations

​2. Signing requests

​Next steps

Installation

Quick start

1. Read-only operations

2. Signing requests

Next steps