Skip to main content
POST
Attach a source to a flow and mint a session token

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Dynamic-Flow-Session-Token
string

Flow session token issued at source attachment. Required when no JWT is provided. Format: dft_.

Path Parameters

environmentId
string
required

ID of the environment

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

flowId
string
required

UUID of the flow

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json

fromAddress, fromChainId, and fromChainName are required when sourceType is 'wallet'. When sourceType is 'exchange', they are optional; pass exchangeProvider to generate the buy URL and create the exchange source record server-side. When sourceType is 'deposit_address', fromChainId and fromChainName are required; fromAddress is not accepted (use refundAddress instead to specify where funds should be returned if the deposit fails).

sourceType
enum<string>
required

How a flow is funded — a connected wallet, a CEX, or a deposit address.

Available options:
wallet,
exchange,
deposit_address
fromAddress
string

Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON)

Maximum string length: 255
Pattern: ^[A-Za-z0-9_-]{18,100}$
Example:

"0xbF394748301603f18d953C90F0b087CBEC0E1834"

fromChainId
string
Maximum string length: 50
Pattern: ^(?=\S)[\p{L}\p{N}a-zA-Z _.,:!?&%@\/+\-'|]+(?<=\S)$
Example:

"An example name"

fromChainName
enum<string>
Available options:
ETH,
EVM,
FLOW,
SOL,
ALGO,
STARK,
COSMOS,
BTC,
ECLIPSE,
SUI,
SPARK,
TRON,
APTOS,
TON,
STELLAR,
ALEO,
TEMPO,
MIDNIGHT
exchangeProvider
enum<string>

Source exchange identifier

Available options:
coinbase,
kraken
refundAddress
string

Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON)

Maximum string length: 255
Pattern: ^[A-Za-z0-9_-]{18,100}$
Example:

"0xbF394748301603f18d953C90F0b087CBEC0E1834"

Response

Source attached; session token minted

Response from the source endpoint — carries the one-time capability session token plus the current flow state.

sessionExpiresAt
string<date-time>
required

When the session token expires.

sessionToken
string
required

Opaque capability token for authenticating subsequent calls on this flow (quote/prepare/broadcast). Minted by the source endpoint and returned exactly once — store it immediately. At most one live token exists per flow at a time. Format: dft_.

Example:

"dct_A1B2C3..."

flow
object
required

A single payment, deposit, or withdraw flow. Collapses the former Checkout and CheckoutTransaction into one resource.

Last modified on July 24, 2026