# Step 3 – Authentication and encryption
source: https://developer.mastercard.com/account-catalog-services/tutorial/build-end-to-end-app/step3/index.md

## Step 3 -- Authentication and encryption {#step-3--authentication-and-encryption}

Once the classes are generated, you can create a new `Main` class and method. All the following code snippets can be added to said method. An example of the file can be found at the [end of this tutorial](https://developer.mastercard.com/account-catalog-services/tutorial/build-end-to-end-app/step5/index.md).

### Authentication {#authentication}

The authentication for each call is done using classes defined by the Mastercard OAuth1 signer library. Instantiating one interceptor for authentication (`OkHttpOAuth1Interceptor`) ensures that the client has the correct privileges to access the server.

```JAVA
// change these values accordingly
String signingKeyFilePath = "#PATH AND NAME OF YOUR P12 FILE HERE#";
String signingKeyAlias = "#YOUR KEY ALIAS HERE#";
String signingKeyPass = "#YOUR KEY PASSWORD HERE#";
String consumerKey = "#YOUR 97 CHARACTER CONSUMER KEY HERE#";

// Step 1.1- Load the signing key - Provided by the OAuth1 Signer lib
PrivateKey signingKey = AuthenticationUtils.loadSigningKey(signingKeyFilePath, signingKeyAlias, signingKeyPass);

// Step 1.2 -- Inject OAuth signing key and consumer key to interceptor
OkHttpOAuth1Interceptor authInterceptor = new OkHttpOAuth1Interceptor(consumerKey, signingKey);
```

### Encryption {#encryption}

The encryption and decryption of the payload for each call are done using classes defined by the Mastercard Client Encryption library. With the instantiation of a second interceptor (`OkHttpEncryptionInterceptor`), the data sent can be adequately protected.

The request body of the service calls is encrypted and put in Mastercard Encryption format. The details of what kind of keys to use, how to request and manage keys, and the algorithms used to encrypt or decrypt are present on the [API Basics](https://developer.mastercard.com/account-catalog-services/documentation/api-basics/index.md) page.

The `OkHttpEncryptionInterceptor` constructor receives a `JweConfig encryption` parameter that should be configured as such.

```JAVA
// change these values accordingly
String clientEncryptionCertPath = "#PATH AND NAME OF YOUR PEM FILE HERE#";
String mastercardEncryptionKeyFilePath = "#PATH AND NAME OF YOUR P12 FILE HERE#";
String mastercardEncryptionAlias = "#YOUR KEY ALIAS HERE#";
String mastercardEncryptionPass = "#YOUR KEY PASSWORD HERE#";

// Step 2.1 - This will be the certificate used to encrypt the payload before sending
Certificate encryptionCertificate = EncryptionUtils.loadEncryptionCertificate(clientEncryptionCertPath);

// Step 2.2 - The response received from the call will need to be decrypted using this key
PrivateKey decryptionKey = EncryptionUtils.loadDecryptionKey(
        mastercardEncryptionKeyFilePath,
        mastercardEncryptionAlias,
        mastercardEncryptionPass);

// Step 2.3 -- Prepare JWEConfig
JweConfig jweConfig = JweConfigBuilder.aJweEncryptionConfig()
        .withEncryptionCertificate(encryptionCertificate)
        .withDecryptionKey(decryptionKey)
        .withDecryptionPath("$.encryptedValue", "$")
        .withEncryptionPath("$", "$")
        .withEncryptedValueFieldName("encryptedValue")
        .build();

// Step 2.4 -- Inject JweConfig to interceptor

String decryptedPayload =JweEncryption.decryptPayload(encryptedPayload, jweConfig);
```

An instance of the `ApiClient` class can be created, adding both interceptors that were instantiated.

```JAVA
// Step 3 -- Create ApiClient
ApiClient apiClient = new ApiClient();

// Step 3.1 -- Configure the Mastercard service URL
apiClient.setBasePath("https://sandbox.api.mastercard.com/asc/acs-api");

// Step 3.2 -- Add the interceptors responsible for signing, encrypting, and decrypting HTTP requests//responses 
apiClient.setHttpClient(
        apiClient.getHttpClient()
                .newBuilder()
                .addInterceptor(encryptionInterceptor)
                .addInterceptor(authInterceptor)
                .build()
);

// Step 3.3 - Enable or disable OK Http debugging - disable on UAT/PROD env.
apiClient.setDebugging(true);
```