# Authentication and Encryption
source: https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/api-basics/authentication-and-encryption/index.md

## Authenticate and secure Ethoca Alerts for Merchants API connections {#authenticate-and-secure-ethoca-alerts-for-merchants-api-connections}

Use this page to understand the authentication and encryption requirements for Ethoca Alerts for Merchants integrations. Review the security mechanisms, certificate requirements, and connection standards needed to securely exchange data with Mastercard services.

### Client authentication {#client-authentication}

The Mastercard-hosted Alerts for Merchants APIs use OAuth 1.0a. Requests to the Pull and Outcome endpoints must include a valid OAuth 1.0a `Authorization` header generated from your consumer key and signing key.

You can either implement the signing logic yourself or use Mastercard OAuth libraries from [GitHub](https://github.com/Mastercard?utf8=%E2%9C%93&q=oauth). For the standard setup flow, see [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/).

### Transport encryption {#transport-encryption}

Transport between your systems and Mastercard is protected with HTTPS using TLS. The OpenAPI specifications do not define a separate payload encryption requirement such as JWE for this API.

### Push webhook certificate trust {#push-webhook-certificate-trust}

If you implement the Push integration, Mastercard delivers alerts to the HTTPS endpoint that you register during onboarding. If your infrastructure validates the certificate chain used by Mastercard client applications, make sure the required DigiCert certificate authorities are present in your trust store.

See [DigiCert Root Certificates](https://developer.mastercard.com/ethoca-alerts-for-merchants/documentation/api-basics/digicert-root-certificates/index.md) for the current root and intermediate certificate details.

### Generate a client or sign requests directly {#generate-a-client-or-sign-requests-directly}

For Pull and Outcome integrations, you can either generate a client from the OpenAPI specifications or send requests with your own HTTP tooling.

* To generate a client, use [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/).
* To implement your own client, use the API reference and apply OAuth 1.0a signing to each request.

Relevant specification downloads:

* Pull API: [alert-delivery-outcome-specs_inbound.yaml](https://static.developer.mastercard.com/content/ethoca-alerts-for-merchants/swagger/alert-delivery-outcome-specs_inbound.yaml) (35KB)
* Outcome API: [alert-delivery-outcome-specs_inbound.yaml](https://static.developer.mastercard.com/content/ethoca-alerts-for-merchants/swagger/alert-delivery-outcome-specs_inbound.yaml) (35KB)
* Push API payload contract: [alerts-push-conflicts-notification-specs-outbound.yaml](https://static.developer.mastercard.com/content/ethoca-alerts-for-merchants/swagger/alerts-push-conflicts-notification-specs-outbound.yaml) (32KB)

### Notes {#notes}

* OAuth 1.0a applies to Mastercard-hosted API calls.
* Push delivery uses your registered HTTPS endpoint rather than a Mastercard base URL.
* No additional payload encryption requirement is defined in the published specifications.