# API Basics
source: https://developer.mastercard.com/consent-management/documentation/api-basics/index.md
## API Security {#api-security}
### Client Authentication {#client-authentication}
The APIs are RESTful APIs with OAuth security. Your API requests must have an OAuth 1.0a Authorization
Header for authentication.
Mastercard uses OAuth 1.0a to authenticate your application. You can manage your authentication keys in the [Developer Dashboard](https://developer.mastercard.com/dashboard) after you create a project. Mastercard provides [client authentication libraries](https://github.com/Mastercard?q=oauth) in several languages that you can integrate with your project or use as a reference in your implementations:
| |  |  |  |  |  | | | |
|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|---|---|---|
| **Download/install** | [](https://search.maven.org/artifact/com.mastercard.developer/oauth1-signer/) | [](https://www.nuget.org/packages/Mastercard.Developer.OAuth1Signer.RestSharpV2/) | [](https://pypi.org/project/mastercard-oauth1-signer/) | [](https://www.npmjs.com/package/mastercard-oauth1-signer) | [](https://github.com/Mastercard/oauth1-signer-go) | | | |
| **View on GitHub** | [](https://github.com/Mastercard/oauth1-signer-java) | [](https://github.com/Mastercard/oauth1-signer-csharp) | [](https://github.com/Mastercard/oauth1-signer-python) | [](https://github.com/Mastercard/oauth1-signer-nodejs) | [](https://github.com/Mastercard/oauth1-signer-go) | | | |
Generate the OAuth 1.0a Authorization Header using the appropriate Production Key and Consumer Key, signed using the Google Request Body Hash extension for OAuth. Your project page shows the Consumer Key, which you can copy using Actions \> Copy Consumer Key. Ensure you copy the Consumer Key shown under Production Keys, not Sandbox Keys.
You can implement your own OAuth 1.0a header or use the relevant Mastercard OAuth libraries available
on [GitHub](https://github.com/Mastercard). For guidance, you can refer to the README.md file.
For detailed information on using OAuth 1.0a with the APIs and generating Authorization Headers, see
[Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/).
### Transport Encryption {#transport-encryption}
The transport between client applications and Mastercard is secured using [TLS/SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security), which means data is encrypted by default when transmitted across networks.
In addition to that, Consent Management \& Enrollment uses JSON Web Encryption (JWE) to provide end-to-end payload encryption to secure sensitive data like Personally Identifying Information (PII). These APIs are identified in the [API Reference](https://developer.mastercard.com/consent-management/documentation/api-reference/index.md). For more information, see [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/).
You can manage your encryption keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) (within the "Client Encryption Keys" section).
## Consume the Consent Management \& Enrollment APIs {#consume-the-consent-management--enrollment-apis}
Note: There are multiple ways of integrating with Consent Management \& Enrollment:
* Using a generated API client (recommended)
* Using a method of your choice
### Generating your own Consent Management \& Enrollment API client {#generating-your-own-consent-management--enrollment-api-client}
Create customizable API clients from the Consent Management \& Enrollment API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers more flexibility and is strongly recommended. Follow the [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with the
[cbc-consent-spec.yaml](https://static.developer.mastercard.com/content/consent-management/swagger/cbc-consent-spec.yaml) (17KB) API specification. For more information about Mastercard encryption libraries available see [Client Authentication](https://developer.mastercard.com/consent-management/documentation/api-basics/index.md#client-authentication).
The encryption method takes a configuration object, which is described below:
* Java
* Python
```java
String ENCRYPTION_KEY_FILENAME = "you-encryption-key.pem";
Certificate encryptionCertificate = EncryptionUtils.loadEncryptionCertificate(
ENCRYPTION_KEY_FILENAME);
JweConfig config = JweConfigBuilder.aJweEncryptionConfig()
.withEncryptionCertificate(encryptionCertificate)
.withEncryptionPath("$", "$")
.withEncryptedValueFieldName("jweEncryptedData")
.build();
```
```python
ENCRYPTION_KEY_FILENAME = "your-encryption-key.pem"
encryptConfig = FieldLevelEncryptionConfig({
"paths": {
"$": {
"toEncrypt": {
"$": "$"
},
"toDecrypt": {}
}
},
"encryptedValueFieldName": "jweEncryptedData",
"encryptionCertificate": ENCRYPTION_KEY_FILENAME
})
```
### Using a method of your choice {#using-a-method-of-your-choice}
Consent Management \& Enrollment exposes a REST API: you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client authentication](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#client-libraries) and [client encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/#client-libraries) libraries for signing your requests and dealing with payload encryption. Refer to the Consent Management \& Enrollment [REST API Reference](https://developer.mastercard.com/consent-management/documentation/api-reference/index.md).
## Environments {#environments}
### Sandbox {#sandbox}
The free tier provides access to the Consent Management \& Enrollment Sandbox environment. Use the test card listed on the [Testing](https://developer.mastercard.com/consent-management/documentation/testing/index.md) page to validate your integration. You must enroll the test card before you can receive test Transaction Notifications. You can configure both the Consents and Transaction Notification APIs as a single project in Sandbox and Production.
Base URL for calling Sandbox endpoints:
* Single-Card
* Bulk-Card
```enrollment
https://sandbox.api.mastercard.com/openapis/authentication
```
```enrollment
https://sandbox.api.mastercard.com/openapis/consents
```
### Production {#production}
After you complete Sandbox testing, the Basic tier enables you to enroll up to 10 cards in the Production environment. You can use any Mastercard card in this tier, but we recommend choosing card types that match your use case. For example, use corporate Mastercard cards if your use case is expense management. To gain full Production access, request the Premium tier.
Base URL for calling Production endpoints:
* Single-Card
* Bulk-Card
```enrollment
https://api.mastercard.com/openapis/authentication
```
```enrollment
https://api.mastercard.com/openapis/consents
```
## Headers {#headers}
With the exception of Authentication, the only required header is `Content-Type` which is `application/json`.
## Next Steps {#next-steps}
### Related Guides {#related-guides}
* [Quick Start Guide](https://developer.mastercard.com/consent-management/documentation/quick-start-guide/index.md)
* [Testing](https://developer.mastercard.com/consent-management/documentation/testing/index.md)
* [API Reference](https://developer.mastercard.com/consent-management/documentation/api-reference/index.md)
### API Status {#api-status}
The Consent Management \& Enrollment API has synthetic monitoring in place that is constantly checking that the API is up and functioning as expected. This information is made available publicly so that you can check the uptime and if there have been any recent issues with the product. Check the [status page](https://developer.mastercard.com/api-status) for this information.
### Developer Tooling {#developer-tooling}
We provide a set of developer tools to help you integrate with the API more easily and get the most value from the account range data. These tools give you a head start when building your connection. For details, see [Developer Tools](https://developer.mastercard.com/consent-management/documentation/developer-tools/index.md).