# Issuer Profile Management
source: https://developer.mastercard.com/issuer-enrollment/documentation/use-cases/auto-enrollment/issuer-profile-management/index.md

Mastercard's Issuer Profile Management is a self-service experience that enables cardholders to manage their issuer-specific Click to Pay profile directly from an issuer's digital channels, such as a mobile banking application or online banking portal. Issuers integrate the service into their existing environments and launch the experience using a secure JSON Web Token (JWT)-based authentication mechanism. Once authenticated, cardholders can view and manage profile information, payment cards, contact details, and issuer-specific settings --- all scoped to the issuer's own Click to Pay directory.

![Issuer Profile Management](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/Issuer-Profile-Management.png "Mastercard Issuer Profile Management customer journey flow")

## Prerequisites {#prerequisites}

Before integrating with Issuer Profile Management, issuers must complete the required onboarding process and provide all configuration information needed to establish and brand the experience.
Note: Issuer Profile Management currently supports consumer profiles with a single email address and a single mobile number. Other profile configurations are not yet supported.

### Required onboarding information {#required-onboarding-information}

|          Configuration Item           | Mandate  |                                                                                                         Description                                                                                                         |
|---------------------------------------|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Issuer CID                            | Required | Unique identifier used by Mastercard systems to identify the issuer.                                                                                                                                                        |
| JWT Signature Verification Public Key | Required | Used to validate the integrity and authenticity of the verification JWT submitted during launch.                                                                                                                            |
| Directory Owner Customization Details | Required | Configuration used to tailor the experience to the issuer's directory ownership settings.                                                                                                                                   |
| Issuer Logo URL                       | Required | Displays the issuer's branding throughout the experience. Upload logo images in SVG or PNG format. For consistent display across the user interface, logo dimensions should not exceed 25 px in height and 150 px in width. |
| Issuer Name                           | Required | Displayed to cardholders within the user interface.                                                                                                                                                                         |
| Issuer Callback URL                   | Optional | Allows cardholders to navigate back to the issuer's application after completing actions.                                                                                                                                   |
| Support Mobile Number or Email        | Required | Displayed to cardholders as a support contact method.                                                                                                                                                                       |
| Issuer Terms and Privacy Policy URLs  | Optional | Displayed within the experience footer to meet issuer-specific legal and compliance requirements.                                                                                                                           |

Note: Issuers must provide all required onboarding information before they can configure Issuer Profile Management and make it available to cardholders. Without the required configuration, cardholders cannot access or use the service.

## Use Cases {#use-cases}

The use cases below focus on how a cardholder launches and uses Issuer Profile Management, including the JWT-based handoff from the issuer's digital channel and the actions a cardholder can take once signed in.

### Launch issuer profile management {#launch-issuer-profile-management}

A cardholder launches Issuer Profile Management from their issuer's mobile or online banking channel. The issuer generates a signed JWT and redirects the cardholder to the launch URL, where the service validates the token, applies issuer branding, and signs the cardholder in to manage their Click to Pay profile.

#### Prerequisites {#prerequisites-1}

* The issuer has completed onboarding and provided all required configuration.
* The issuer has a valid signing key registered with Mastercard.
* The cardholder is already authenticated within the issuer's own digital channel.

#### Desired outcome {#desired-outcome}

The cardholder is securely authenticated and lands in the issuer-branded Profile Management experience, ready to manage their Click to Pay profile.

#### Example sequence {#example-sequence}

Diagram issuer-profile-management

#### Steps to launch Issuer Profile Management {#steps-to-launch-issuer-profile-management}

1. The cardholder selects the Click to Pay profile management entry point in the issuer's app or website.
2. The issuer generates a signed verification JWT that includes the required header and claims.
3. The issuer redirects the cardholder to the launch URL, passing the JWT as the `auth` parameter and an optional `locale` parameter.
4. Issuer Profile Management validates the JWT signature, expiration, and claims.
5. On successful validation, the service applies the issuer's configured branding.
6. On successful authentication, the cardholder is taken to the Profile Management portal.

#### Key parameters {#key-parameters}

**Launch URL**

    https://src.mastercard.com/profile/issuer?auth=<JWT>&locale=<xx_YY>

| Parameter | Required |                          Description                          |
|-----------|----------|---------------------------------------------------------------|
| `auth`    | Yes      | Signed JWT used for authentication and issuer identification. |
| `locale`  | No       | Locale used to localize the user experience.                  |

**JWT header**

```json
{
  "alg": "RS256",
  "kid": "<Kid>",
  "typ": "JWT+ext.issuer_token"
}
```

| Attribute |                                  Description                                  |
|-----------|-------------------------------------------------------------------------------|
| `alg`     | JWT signing algorithm.                                                        |
| `kid`     | Issuer API key used to identify the public key used for signature validation. |
| `typ`     | JWT token type.                                                               |

**JWT claims**

```json
{
  "iss": "https://<issuer-domain>",
  "sub": "<uuid>",
  "aud": "https://mastercard.com",
  "exp": "<expiration>",
  "iat": "<issued>",
  "jti": "<uuid>",
  "programId": "<Issuer Program Id>",
  "clientId": "<Issuer Client Id>"
}
```

|    Claim    |                      Description                      |
|-------------|-------------------------------------------------------|
| `iss`       | Issuer domain identifier.                             |
| `sub`       | Unique cardholder identifier generated by the issuer. |
| `aud`       | Token audience.                                       |
| `exp`       | Expiration timestamp in Epoch format.                 |
| `iat`       | Issued timestamp in Epoch format.                     |
| `jti`       | Unique JWT identifier generated by the issuer.        |
| `programId` | Issuer program identifier.                            |
| `clientId`  | Issuer client identifier.                             |

#### Example launch request {#example-launch-request}

    https://src.mastercard.com/profile/issuer?auth=eyJhbGciOiJSUzI1NiIsImtpZCI6...&locale=en_US

#### Example response {#example-response}

The cardholder's browser loads the Issuer-branded Profile Management portal in an authenticated state. No API response body is returned to the Issuer; success is observed via the rendered experience.
Note: The auth parameter is mandatory. The locale parameter is optional.

### Manage profile, cards, and contact information {#manage-profile-cards-and-contact-information}

Once signed in, the cardholder can view and update the Click to Pay profile information tied to their Issuer, including enrolled cards, email address, phone number, and shipping and billing addresses. Each action is initiated by the cardholder from within the authenticated portal session, and the Issuer Profile Management service applies the change directly to the Issuer's Click to Pay directory.

#### Prerequisites {#prerequisites-2}

* The cardholder has successfully completed Use Case 1 and holds an active session.
* The action taken depends on the cardholder having eligible data (for example, at least one card enrolled to remove a card).

#### Desired outcome {#desired-outcome-1}

The requested change is applied to the cardholder's issuer-specific profile and reflected immediately in the portal.

#### Example sequences {#example-sequences}

Diagram issuer-profile-management-actions

#### Available actions {#available-actions}

After signing in, the cardholder can:

* View and manage Click to Pay profile information associated with the Issuer.
* Add additional cards issued by the same Issuer.
* Remove cards issued by the same Issuer.
* Update email addresses and mobile phone numbers.
* Modify address information, such as billing and shipping addresses.
* View Issuer support and contact details.
* Remove their issuer-specific Click to Pay profile from the issuer directory (see Use Case 3).

#### Steps to manage customer profile {#steps-to-manage-customer-profile}

1. The cardholder selects the action they want to take (for example, **Add card** or **Update email**).
2. The portal displays the appropriate form or confirmation prompt.
3. The cardholder submits the update.
4. Issuer Profile Management validates the input and applies the change to the Issuer's Click to Pay directory.
5. The portal confirms success and refreshes the affected view.

#### Data scope {#data-scope}

All changes made through Issuer Profile Management apply only to the issuer's own Click to Pay directory. Updates do not affect the cardholder's profiles maintained by other issuers.

### Remove issuer-specific Click to Pay profile {#remove-issuer-specific-click-to-pay-profile}

When a cardholder no longer wants to participate in an Issuer's Click to Pay directory --- for example, when closing an account or opting out of the service --- they can remove their issuer-specific profile from within an authenticated Issuer Profile Management session. The cardholder initiates the removal from the portal, confirms the action, and the Issuer Profile Management service permanently deletes the profile from the Issuer's Click to Pay directory. Profiles the cardholder maintains with other Issuers are unaffected.

#### Prerequisites {#prerequisites-3}

* The cardholder is authenticated in Issuer Profile Management.
* A profile exists for the cardholder within the Issuer's Click to Pay directory.

#### Desired outcome {#desired-outcome-2}

The cardholder's issuer-specific Click to Pay profile is permanently removed from the Issuer's directory. Profiles held with other Issuers are unaffected.

#### Example sequence {#example-sequence-1}

Diagram issuer-profile-management-delete

#### Steps to remove a customer profile {#steps-to-remove-a-customer-profile}

1. The cardholder selects the option to remove their issuer-specific profile.
2. The portal displays a confirmation prompt describing the impact of the action.
3. The cardholder confirms the removal.
4. Issuer Profile Management deletes the profile from the Issuer's Click to Pay directory.
5. The portal confirms the successful removal.

Note: Removal is scoped to the issuer's own Click to Pay directory. It does not affect Click to Pay profiles the cardholder maintains with other issuers.

## Error Handling and Scenarios {#error-handling-and-scenarios}

Issuer Profile Management is a hosted experience and does not return API error codes to the issuer. If the portal cannot validate the JWT passed through the required `auth` parameter, it displays an error screen.

![Issuer Profile Management launch screen error](https://static.developer.mastercard.com/content/issuer-enrollment/documentation/img/issuer-profile-management-error.png "Error screen")

### Scenario: Issuer Profile Management does not launch {#scenario-issuer-profile-management-does-not-launch}

**Cause:** The launch URL does not include a valid JWT in the `auth` parameter, or the portal cannot validate the supplied JWT.

**Resolution:**

1. Confirm that the launch URL includes the required `auth` parameter.
2. Verify that the parameter contains the complete JWT.
3. Confirm that the JWT contains the required claims and correct issuer information.
4. Verify that the JWT has not expired.
5. Confirm that the JWT is signed using the private key associated with the public verification key supplied during onboarding.
6. Generate a new JWT and launch Issuer Profile Management again.

If the error continues after validating the launch URL and JWT, contact Mastercard support.

## Next Steps {#next-steps}

After completing the required onboarding and configuration:

* Add the Issuer Profile Management entry point to the appropriate mobile or online banking experience.
* Generate the verification JWT and include it in the `auth` parameter of the launch URL.
* Test the launch experience and confirm that the portal applies the expected issuer branding.
* Verify that users can access and manage their issuer-specific profiles.
* Contact Mastercard support if the portal displays an error after the launch URL and JWT have been validated.