# API Basics
source: https://developer.mastercard.com/doconomy-aland-index/documentation/api-basics/index.md

The Doconomy Aland Index API is organized around REST principles.
The API has predictable resource-oriented URLs, accepts JSON request bodies, returns JSON-encoded responses, and uses standard HTTP response codes, authentication, and verbs.

## Protocols {#protocols}

The Doconomy Aland Index API uses both POST and GET requests to communicate and HTTP response codes to indicate status and errors. All responses come in the standard JSON format. These APIs are served over HTTPS TLS v1.2 to ensure data privacy; HTTPS with TLS versions below v1.2 is not supported. All POST requests must include a highlight `Content-Type` of `application/json,` and the body must be valid a JSON object.

## Authentication {#authentication}

The Doconomy Aland Index API uses API keys to authenticate requests. Mastercard uses one-legged OAuth 1.0a for authenticating and authorizing client applications. It means, every request sent must be digitally signed, and requests with valid signatures created by authorized clients are granted access to the services. Also, requests with a body must be signed using the Google Request Body Hash extension for OAuth. If you do not include your key when requesting the API or use the incorrect or outdated key, Mastercard will return an error.

In short, to generate a private-public RSA key pair:

* Keep the private key to create the OAuth signature for all your requests. We recommend keeping your private key in a password-protected or hardware key store.
* The public key is shared with Mastercard during the setup process as a Certificate Signing Request (CSR). Mastercard uses the public key to verify the OAuth signature that you will provide on every API call.

Refer to [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#overview) for more details.

### Obtaining API keys {#obtaining-api-keys}

The API keys are available in your project dashboard on Mastercard Developers. You will use the sandbox keys for testing and development. A different set of keys are required for the Production environment.

Refer to the page for more information on [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/#overview).
Note: If you haven't downloaded the keys yet, refer to the [Getting Started](https://developer.mastercard.com/doconomy-aland-index/documentation/getting-started/index.md) section.

## Environments {#environments}

The table below describes the different environments that are available.

|              **Environment**              |                                                                                                                  **Description**                                                                                                                   |
|-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox - MTF (Mastercard Test Facility). | The pre-production test environment contains the latest pre-release or released version of the APIs, intended for full integration testing before moving to production. At this stage, use the sandbox keys generated during the project creation. |
| Production                                | The production environment contains the latest production API release. You can request approval to obtain the production keys. Once approved, you can proceed to complete testing in the production environment before launching your solution.    |

## Next Steps: {#next-steps}

Now that you have an understanding of the services protocols and authentication, proceed to the [Quick Start Guide](https://developer.mastercard.com/doconomy-aland-index/documentation/quick-start-guide/index.md) section to learn how to access the API and generate your credentials.