Key Management Run any key anywhere, from one platform.

// Same key — wallets on Ethereum, Polygon, Base, Arbitrum, etc.
const ethereum = await dfnsApi.wallets.createWallet({
  body: { network: "Ethereum", signingKey: { id: key.id }, name: "Treasury — ETH" }
});
const polygon  = await dfnsApi.wallets.createWallet({
  body: { network: "Polygon",  signingKey: { id: key.id }, name: "Treasury — MATIC" }
});

// ethereum.address === polygon.address — same key, same EVM address
// On Bitcoin or Solana, different address derivation, same underlying key

// Authenticate the request with a passkey-signed user action
const userActionSignature = await dfnsApi.auth.signUserAction({
  challenge,
  credential: await navigator.credentials.get({ publicKey: { challenge } })
});

// Sign a payload — the policy engine evaluates BEFORE the MPC network signs
const signature = await dfnsApi.keys.generateSignature({
  keyId: key.id,
  body: {
    kind: "Hash",
    hash: "0xabc...def"            // 32-byte hash to sign
  },
  userActionSignature
});

// Authentication credential ≠ signing key. Two domains, two attack surfaces.
// Compromise of either alone signs nothing.

// Managed SaaS — the default. All shares in DFNS enclaves.
const dfnsApi = new DfnsApiClient({
  baseUrl: "https://api.dfns.io",
  // ...
});

// Hybrid — you hold one or more shares in your own infrastructure
// Configured during onboarding; the signing flow is otherwise identical
// DFNS cannot sign without your share; you cannot sign without DFNS

// On-premises — entire MPC stack inside your data center
// Same SDK, different base URL, full operational control
const onPremApi = new DfnsApiClient({
  baseUrl: "https://dfns.your-bank.internal",
  // ...
});