Register a partner customer
Creates a Dime Trades trading account for a user who already exists on an ISV / partner platform, keyed by the pair (brandId, externalCustomerId).
Server-to-server only. All /partner/* endpoints are authenticated with your brand credentials — X-API-Key + X-API-Secret headers — not with an end-user bearer token. Never expose these credentials to a browser or mobile app.
Create-or-get
The call is idempotent on (brandId, externalCustomerId). If the pair is already registered, no second account is created — the existing account is returned with a fresh access + refresh token pair, and any profile fields you send are ignored.
What you get back
A token (bearer token for that user) and a refreshToken, so a freshly registered user can start trading immediately without a separate session round-trip.
Verification & compliance
Accounts are created with isKycVerified defaulting to false. You need to call the KYC partner API (PATCH /partner/customers/kyc) to make it verified or true. Discovery endpoints work right away; deposits, withdrawals and order placement stay blocked with 403 until KYC is completed.
Session / device limits
Each session is bound to a deviceId. A user can hold at most max_user_sessions (5) active device sessions; creating a new one at that limit fails with MAX_USER_SESSIONS_REACHED (403). Use the refresh-token and logout endpoints to manage existing sessions.
Authorizations
ISV / partner credential — public half. Required on every request.
Identifies the integration partner (ISV) making the call. Issued by Dime
Trades when the ISV is onboarded and sent on every /partner/* endpoint:
X-API-Key: dt_pk_live_7f3c9a2e5b18
- On the two partner endpoints that create accounts or issue tokens (
POST /partner/customers,POST /partner/customers/login), it is accompanied byX-API-Secretand is the only authentication — there is no user token yet. - On every other partner endpoint it is sent alongside the user's
Authorization: Bearer <token>: the API key says which platform is calling, the bearer token says which user it is calling for.
Credentials are scoped to one or more brands; using a key with a brandId outside that scope returns 403. Staging and production keys are separate.
The key identifies your platform — treat it as a backend credential.
ISV / partner credential — secret half. Sent on every /partner/* endpoint.
The confidential counterpart to X-API-Key. It is required, together with the key, on every /partner/* endpoint: register, login, refresh-token, logout, kyc, wallet-instructions and the replay endpoints. Outside /partner/* — the ordinary user API, called with a user's bearer token — the key is sent without the secret.
X-API-Key: dt_pk_live_7f3c9a2e5b18 X-API-Secret: dt_sk_live_9d41ba07c6e2f85a3b7c1049de26f8b1
A request to a /partner/* endpoint that has a key without its matching secret is rejected with 401. The secret is shown once at issue time and stored only as a hash on our side — if it is lost or exposed, rotate the pair from the partner console rather than asking for a copy. Never ship it in a browser or mobile client: anyone holding it can mint a token for any of your users.
Body
The user's identifier on your platform. Stored verbatim and used as the lookup key for every later call. Must be stable for the lifetime of the account.
1 - 128"ext-123"
User's email. Required and must be unique across Dime Trades.
Unique username. Can only contain letters and numbers (no spaces or special characters).
1^[a-zA-Z0-9]+$"johndoe123"
Unique identifier for the device/session. Used for refresh token rotation. Must be stable per device. Recommended: a UUID.
1"device-uuid-123"
1 - 128"John"
1 - 128"Doe"
Date of birth, YYYY-MM-DD.
"1990-01-01"
Country code (ISO 3166-1 alpha-2).
2 - 4"US"