# Secure Your API Integration with mTLS Authentication on Mastercard Developers
source: https://developer.mastercard.com/blog/mtls/index.md

Authors: Ankita Matkar. In today's digital landscape, security is essential when integrating with APIs. Mastercard Developers offers Mutual Transport Layer Security (mTLS) Authentication for several APIs hosted on our platform. What is mTLS? Mutual TLS Authentication (MTLS) is a two-way authentication mechanism built on Transport Layer Security (TLS) that uses X.509 digital certificates signed via Public Key Infrastructure (PKI). Unlike one-way TLS, where only the server proves its identity, MTLS requires both client and server to authenticate each other before any data exchange. This establishes a trusted, encrypted channel protecting sensitive transactions from interception or tampering. mTLS Authentication Flow How mutual trust is estabilished using mTLS Client Initiates Connection: Your application opens a secure connection to a Mastercard API endpoint. Server Certificate Presentation: Mastercard server presents its certificate for identity verification. Client Certificate Presentation: Your application presents its client certificate (obtained via Mastercard Developers) proving it is authorized. Mutual Verification: Both certificates are validated against trusted Certificate Authorities. Secure Channel Established: A mutually authenticated, encrypted session is negotiated. Service Authorization: The server authenticates and authorizes the client-certificate for the requested API service. API Request Processing: Requests and responses flow over the secure, verified channel. This two-way authentication model ensures that only authorized clients with valid certificates can access Mastercard APIs, significantly reducing the risk of unauthorized access, man-in-the-middle attacks, and other security vulnerabilities. Cryptographic Foundations mTLS authentication relies on proven cryptographic standards to ensure security through multiple layers of protection. RSA and ECDSA algorithms provide digital signatures that verify certificate authenticity, while key exchange mechanisms establish session keys for encrypting data in transit. Secure hash functions like SHA-256 and SHA-512 are used to generate message digests to detect tampering and ensure data integrity throughout the entire communication session. Public Key Infrastructure (PKI) provides the trust framework through Certificate Authorities (CAs) that cryptographically sign certificates, creating a verifiable chain of trust where each certificate can be validated back to a root CA, ensuring only authorized parties participate in the communication. This layered cryptographic approach protects sensitive financial data against unauthorized access, tampering, and man-in-the-middle attacks. Fully Automated Certificate Management Mastercard Developers supports full automation for signing and provisioning mTLS certificates for your API integrations. Below are a few ways you can quickly set up and start consuming Mastercard mTLS APIs. Generate client-certificates on Mastercard Developers (Recommended for Sandbox) Request a fully provisioned mTLS certificate for Sandbox APIs directly during project creation. This option generates a fully provisioned client certificate with secure and local credential generation, enabling developers to start integration and testing APIs in sandbox in seconds. Have your own certificate from a third-party CA? Upload certificates obtained from our supported third-party CAs to leverage existing enterprise trust. After upload, the certificate is immediately provisioned and authorized for approved services within your project. Have Your Own Key and CSR? Simply add your Certificate Signing Request (CSR) to your Mastercard Developers project and request an API certificate. A Mastercard signed certificate will be provisioned for you immediately and can be downloaded from your dashboard at any time. Once you're approved for the service, the certificate will be activated automatically. Mastercard Developers handles all back-end provisioning tasks, allowing you to focus on building your application rather than managing infrastructure. Time for Certificate Renewal? Add a new certificate using any of the methods above and it will be provisioned immediately for all services on your Mastercard Developers project. When you've updated your API integration to use the new certificate, you can remove the old, potentially expired, one from your project dashboard. Summary mTLS on Mastercard Developers delivers mutual authentication, strong encryption, and streamlined, automated certificate lifecycle management, helping you secure integrations faster and with less operational overhead. Ready to Get Started? Here are some popular Mastercard APIs that support MTLS authentication : Identity Insights for Accounts - Optimize your account opening workflows with dynamic identity data to accurately assess risk and convert more consumers. Account to Account Commerce - A fast, secure, and convenient way for your customers to pay with their trusted mobile banking app. Each service documentation includes API references and examples showing how to configure your mTLS client certificate. Sign up for a free Mastercard Developers account and arequest access to create project with one of our mTLSmTLS -enabled APIs today. Follow our step-by-step Using mTLS to Access Mastercard APIs guide to configure your first secure integration in minutes. Start building trusted, encrypted connections to Mastercard services and experience enterprise-grade security without the complexity.