# Decrypt the Payload
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_guestcheckout/step4/index.md

## Step 4. Decrypt the Payload {#step-4-decrypt-the-payload}

Decrypt the `encryptedPayload` using your private key from the Payload Encryption public / private key pair. Mastercard uses the public key of this key-pair to encrypt response payloads containing payment card credentials.

See [Key Management](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md) to understand more about which keys to use to decrypt the payload.

|            dynamicDataType             |                                  Description                                  |                                                                                                                                                                                                                    Payload format                                                                                                                                                                                                                     |
|----------------------------------------|-------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM | Payment authorization using DSRP cryptogram passed in **dynamicData** object. | **DSRP** : Dynamic Secure Remote Payments (DSRP) cryptogram is a type of dynamic data which the Integrator will have to pass within Dynamic Payment Data field (DE104 SE001) of the payment authorization request. This cryptogram is base64 encoded and can be up to 32 characters in length. It is passed in the [Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API. |

Diagram encryption_decryption

1. For decrypting the payload, you can use [Mastercard's encryption/decryption libraries](https://github.com/Mastercard?&q=client-encryption)
2. [Add the library](https://github.com/Mastercard/oauth1-signer-java#maven) to your project.
3. Define `util`, which will set the JWE Decryption configuration as per instructions defined in the library.

```Java
private static JweConfig decryptionConfig; // Configuration defined by library
public static JweConfig getDecryptionConfig() throws Exception {
if (ObjectUtils.isEmpty(decryptionConfig)) {
File decryptionCert = ResourceUtils.getFile("{{Decryption Certificate Path}}"); //.p12 file
PrivateKey decryptionKey = EncryptionUtils.loadDecryptionKey(
decryptionCert.getPath(),
{{decryptionCertAlias}},
{{decryptionCertPassword}});
decryptionConfig = JweConfigBuilder.aJweEncryptionConfig()
.withDecryptionKey(decryptionKey)
.withDecryptionPath("$.encryptedPayload", "$")
.withEncryptedValueFieldName("encryptedPayload")
.build();
}
return decryptionConfig;
}
```

4. Define a service interface and implementation for decryption using configuration defined in util.   

4.1. Service Interface: To define behavior and structure of the decryption function.

```Java
DecryptedPayloadDTO getDecryptedPayload(guestCheckoutTokenizationResponseDTO guestCheckoutTokenizationResponseDTO) throws Exception;
```

4.2. Service Implementation: Implement service function as per the defined interface.

```Java
public DecryptedPayloadDTO getDecryptedPayload(guestCheckoutTokenizationResponseDTO guestCheckoutTokenizationResponseDTO) throws
Exception {
JweConfig jweConfig = guestCheckoutTokenizationUtils.getDecryptionConfig();
String payload = JweEncryption.decryptPayload(new Gson().toJson(guestCheckoutTokenizationResponseDTO), jweConfig);
DecryptedPayloadDTO decryptedPayload = new Gson().fromJson(payload,DecryptedPayloadDTO.class)
return decryptedPayload;
}
```

When the `encryptedPayload` field is decrypted, you will see a JSON object containing transaction information.
* DSRP

```DSRP
// DSRP cryptogram in the dynamicData object
// Sample Decrypted Payload
{
 "dynamicData": {
 "dynamicDataValue": "MMUJZa0RqWXo2M2NSZ29jS2xlOEgzYjRs",
 "dynamicDataType": "CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM"
 },
 "token": {
 "paymentToken": "5455039458295123",
 "paymentAccountReference": "5001a9f027e5629d11e3949a0800b",
 "tokenExpirationMonth": "11",
 "tokenExpirationYear": "2031"
 }
}
```

|                        Field                         |                                        Description                                         |
|------------------------------------------------------|--------------------------------------------------------------------------------------------|
| **token** object                                     | Indicates that the transaction has been tokenized.                                         |
| ↳ **paymentToken**                                   | A 16 digit token rather than a PAN.                                                        |
| ↳ **tokenExpirationMonth** ↳ **tokenExpirationYear** | Parameters which provide the tokenized values for digitized card.                          |
| ↳ **paymentAccountReference**                        | Non-transactable value that is paired with an FPAN, and is linked to the associated token. |
| **dynamicData** object                               | A cryptogram object.                                                                       |
| ↳ **dynamicDataValue**                               | Containing the 32 char DSRP cryptogram in base64.                                          |
| ↳ **dynamicDataType**                                | `CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM` indicates DSRP.                                   |

Once Mastercard Checkout Solution receives the payload response for a tokenized payment, they can proceed to make a payment authorization with their acquirer or payment provider.