Skip to main content
POST
Attach a source to a flow and mint a session token

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Dynamic-Flow-Session-Token
string

Flow session token issued at source attachment. Format: dft_. Required when no JWT is provided, except on attachFlowSource, where it is required only when re-attaching from the signing state.

Path Parameters

environmentId
string
required

ID of the environment

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

flowId
string
required

UUID of the flow

Required string length: 36
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"95b11417-f18f-457f-8804-68e361f9164f"

Body

application/json

fromAddress, fromChainId, and fromChainName are required when sourceType is 'wallet'. When sourceType is 'exchange', they are optional; pass exchangeProvider to generate the buy URL and create the exchange source record server-side. When sourceType is 'deposit_address', fromChainId, fromChainName, and refundAddress are all required (refundAddress specifies where funds should be returned if the deposit fails); fromAddress is not accepted.

sourceType
enum<string>
required

How a flow is funded — a connected wallet, a CEX, or a deposit address.

Available options:
wallet,
exchange,
deposit_address
fromAddress
string

Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON)

Maximum string length: 255
Pattern: ^[A-Za-z0-9_-]{18,100}$
Example:

"0xbF394748301603f18d953C90F0b087CBEC0E1834"

fromChainId
string
Maximum string length: 50
Pattern: ^(?=\S)[\p{L}\p{N}a-zA-Z _.,:!?&%@\/+\-'|]+(?<=\S)$
Example:

"An example name"

fromChainName
enum<string>
Available options:
ETH,
EVM,
FLOW,
SOL,
ALGO,
STARK,
COSMOS,
BTC,
ECLIPSE,
SUI,
SPARK,
TRON,
APTOS,
TON,
STELLAR,
ALEO,
TEMPO,
MIDNIGHT
exchangeProvider
enum<string>

Source exchange identifier

Available options:
coinbase,
kraken,
gemini,
binance
refundAddress
string

Valid blockchain wallet address, must be an alphanumeric string (underscores allowed for chains like Midnight, hyphens allowed for chains using base64url-encoded addresses like TON)

Maximum string length: 255
Pattern: ^[A-Za-z0-9_-]{18,100}$
Example:

"0xbF394748301603f18d953C90F0b087CBEC0E1834"

Response

Source attached; session token minted

Response from the source endpoint — carries the one-time capability session token plus the current flow state.

sessionExpiresAt
string<date-time>
required

When the session token expires.

sessionToken
string
required

Opaque capability token for authenticating subsequent calls on this flow (quote, prepare, broadcast, cancel). Minted by the source endpoint and returned exactly once — store it immediately. At most one live token exists per flow at a time. Format: dft_.

Example:

"dft_A1B2C3..."

flow
object
required

A single payment, deposit, or withdraw flow. Collapses the former Checkout and CheckoutTransaction into one resource.