# Upgrading from OAuth 1.0a to OAuth 2.0
source: https://developer.mastercard.com/digital-redemptions/documentation/upgrade-to-oauth2/index.md

## Overview {#overview}

This guide walks existing Digital Redemptions customers through upgrading their Mastercard Developers project from **OAuth 1.0a** to **OAuth 2.0 + FAPI**. This is the recommended path if you already have a Digital Redemptions integration and want to adopt OAuth 2.0 with minimal disruption.
>
> ### You can follow this guide to learn: {#you-can-follow-this-guide-to-learn}
>
> * What changes when you upgrade to OAuth 2.0.
> * How to add Mastercard Digital Redemptions to your existing project.
> * How to upgrade your project's authentication model.
> * How to update your application to use OAuth 2.0 tokens.
> * How to request Production Access for the additional API.
Note: **Dual Authentication Support**

Mastercard Digital Redemptions supports **OAuth 1.0a** and **OAuth 2.0** simultaneously. After upgrading, your existing OAuth 1.0a signing key, encryption key, and Client ID will continue to work unchanged. For OAuth 2.0 calls, use your existing Client ID --- you simply won't use the Consumer ID portion of it. You can migrate your application to OAuth 2.0 at your own pace without breaking your existing integration.

## What's Different About OAuth 2.0 {#whats-different-about-oauth-20}

|                          |                  OAuth 1.0a                   |                           OAuth 2.0 + FAPI                           |
|--------------------------|-----------------------------------------------|----------------------------------------------------------------------|
| **Authentication model** | Per-request signing with RSA private key      | Token-based (Client Credentials Grant) with DPoP binding             |
| **APIs in your project** | Mastercard Digital Redemptions                |                                                                      |
| **Encryption key**       | Mastercard Digital Redemptions encryption key | Same Digital Redemptions encryption key --- no change required       |
| **Client credentials**   | P12 file + Consumer Key                       | Same P12 file + existing Client ID (Consumer ID portion is not used) |

## Upgrade Your Project {#upgrade-your-project}

### Step 1 --- Sign in and open your existing project {#step-1--sign-in-and-open-your-existing-project}

1. Navigate to [Mastercard Developers](https://developer.mastercard.com) and sign in.
2. Go to your [My Projects](https://developer.mastercard.com/dashboard) page.
3. Select your existing Mastercard Digital Redemptions project. ![My Projects page showing existing Mastercard Digital Redemptions project](https://static.developer.mastercard.com/content/digital-redemptions/img/merchandise/tutorial/upgrade-oauth2-myprojects.png)

### Step 2 --- Upgrade the project to OAuth 2.0 {#step-2--upgrade-the-project-to-oauth-20}

1. From your project page, locate the **Authentication** or **Security** settings.
2. Click **Upgrade to OAuth 2.0** (or the equivalent option shown in your project). ![Upgrade to OAuth 2.0 button on project settings page](https://static.developer.mastercard.com/content/digital-redemptions/img/merchandise/tutorial/upgrade-oauth2-bundledapis.png)
3. Review and confirm the upgrade. ![Confirmation screen for the OAuth 2.0 upgrade](https://static.developer.mastercard.com/content/digital-redemptions/img/merchandise/tutorial/upgrade-oauth2-confirmupgrade.png)

Note: The project will be configured with **dual authentication** --- both OAuth 1.0a and OAuth 2.0 will be supported simultaneously. Your existing OAuth 1.0a integration will not be affected.

### Step 4 --- Confirm the API and encryption keys {#step-4--confirm-the-api-and-encryption-keys}

After the upgrade, verify the project contains API and encryption keys.

![Project summary showing Digital Redemptions API with encryption keys](https://static.developer.mastercard.com/content/digital-redemptions/img/merchandise/tutorial/upgrade-oauth2-keys.png)

* **Mastercard Digital Redemptions** --- present ✓
* **Digital Redemptions encryption key** --- present ✓

### Step 5 --- Update your application to use OAuth 2.0 {#step-5--update-your-application-to-use-oauth-20}

Replace OAuth 1.0a request signing with OAuth 2.0 token-based authentication:

* Request an OAuth 2.0 access token using the Client Credentials Grant.
* Include a DPoP proof with each token request and each API call.
* Call Digital Redemptions APIs using `Authorization: DPoP <access_token>` and a fresh DPoP proof.
* Continue using the **Digital Redemptions encryption key** to encrypt request payloads.

Tip: For a full implementation walkthrough including DPoP proof construction and nonce handling, see the official Mastercard guide: [Using OAuth 2.0 to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-2-to-access-mastercard-apis/).

### Step 6 --- Request Production Access for Mastercard Digital Redemptions {#step-6--request-production-access-for-mastercard-digital-redemptions}

Once you have validated your OAuth 2.0 integration in Sandbox, request Production Access for the Digital Redemptions API. This can be done at any time after Step 2.

1. From your project page, go to the **Production** section.
2. Click **Request Production Access** next to **Mastercard Digital Redemptions** . ![Request Production Access for Mastercard Digital Redemptions](https://static.developer.mastercard.com/content/digital-redemptions/img/merchandise/tutorial/upgrade-oauth2-prodaccess.png)

Note: Typically, it takes 3--5 working days to review and approve a Production access request. You will receive an email from Mastercard Developers at your registered email address with the outcome.