# Decrypt the Payload
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/integrate_apis_scof/step8/index.md

## Step 7: Decrypt the Payload {#step-7-decrypt-the-payload}

Decrypt the `encryptedPayload` using your private key from the Payload Encryption public / private key pair. Mastercard uses the public key of this key-pair to encrypt response payloads containing payment card credentials.

See [Key Management](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md) to understand more about which keys to use to decrypt the payload.

The payload will be returned in the most secure format possible and in accordance with the `DpaTransactionOptions.PaymentOptions.dynamicDataType` parameter passed in the [Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API.

|            dynamicDataType             |                                  Description                                  |                                                                                                                                                                                                                    Payload format                                                                                                                                                                                                                     |
|----------------------------------------|-------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM | Payment authorization using DSRP cryptogram passed in **dynamicData** object. | **DSRP** : Dynamic Secure Remote Payments (DSRP) cryptogram is a type of dynamic data which the Integrator will have to pass within Dynamic Payment Data field (DE104 SE001) of the payment authorization request. This cryptogram is base64 encoded and can be up to 32 characters in length. It is passed in the [Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API. |

Diagram encryption_decryption

1. For decrypting the payload, you can use [Mastercard's encryption/decryption libraries](https://github.com/Mastercard?&q=client-encryption)
2. [Add the library](https://github.com/Mastercard/oauth1-signer-java#maven) to your project.
3. Define `util`, which will set the JWE Decryption configuration as per instructions defined in the library.

```Java
private static JweConfig decryptionConfig; // Configuration defined by library
public static JweConfig getDecryptionConfig() throws Exception {
if (ObjectUtils.isEmpty(decryptionConfig)) {
File decryptionCert = ResourceUtils.getFile("{{Decryption Certificate Path}}"); //.p12 file
PrivateKey decryptionKey = EncryptionUtils.loadDecryptionKey(
decryptionCert.getPath(),
{{decryptionCertAlias}},
{{decryptionCertPassword}});
decryptionConfig = JweConfigBuilder.aJweEncryptionConfig()
.withDecryptionKey(decryptionKey)
.withDecryptionPath("$.encryptedPayload", "$")
.withEncryptedValueFieldName("encryptedPayload")
.build();
}
return decryptionConfig;
}
```

4. Define a service interface and implementation for decryption using configuration defined in util.   
   4.1. Service Interface: To define behavior and structure of the decryption function.

```Java
DecryptedPayloadDTO getDecryptedPayload(clicktopayResponseDTO clicktopayResponseDTO) throws Exception;
```

4.2. Service Implementation: Implement service function as per the defined interface.

```Java
public DecryptedPayloadDTO getDecryptedPayload(clicktopayResponseDTO clicktopayResponseDTO) throws
Exception {
JweConfig jweConfig = clicktopayUtils.getDecryptionConfig();
String payload = JweEncryption.decryptPayload(new Gson().toJson(clicktopayResponseDTO), jweConfig);
DecryptedPayloadDTO decryptedPayload = new Gson().fromJson(payload,DecryptedPayloadDTO.class)
return decryptedPayload;
}
```

When the `encryptedPayload` field is decrypted, you will see a JSON object containing transaction information.
* DSRP

```DSRP
// DSRP cryptogram in the dynamicData object
{
  "token": {
    "paymentToken": "5480983179133165",
    "tokenExpirationMonth": "07",
    "tokenExpirationYear": "22",
    "paymentAccountReference": "50017Q9JP3JRJXIZ1BXQL2MKMX4LE"
  },
  "shippingAddress": {
    "addressId": "adb12da8-474b-4e53-9c3b-5541af7c27bf",
    "name": "John doe",
    "line1": "test address",
    "city": "New York",
    "state": "NY",
    "countryCode": "US",
    "zip": "10011"
  },
  "consumerEmailAddress": "johndoe@dummyemail.com",
  "consumerFirstName": "john",
  "consumerLastName": "doe",
  "consumerFullName": "john doe",
  "consumerMobileNumber": {
    "countryCode": "1",
    "phoneNumber": "9912797896"
  },
  "srcTokenResultsData": {
    "unpredictableNumber": "63f43cff",
    "tokenRequesterId": "50123197928"
  },
  "dynamicData": {
    "dynamicDataValue": "AIrqb3XZSbgpAAl2lQeDGgADFA==",
    "dynamicDataType": "CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM"
  },
  "billingAddress": {
    "addressId": "3374e6e9-293a-4612-aa5d-0e42a8ff7aae",
    "name": "John doe",
    "line1": "test address",
    "city": "New York",
    "state": "NY",
    "countryCode": "US",
    "zip": "10011"
  }
}
```

|                        Field                         |                                                   Description                                                   |
|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------|
| **token** object                                     | Indicates that the transaction has been tokenized.                                                              |
| ↳ **paymentToken**                                   | A 16 digit token rather than a PAN (Primary Account Number).                                                    |
| ↳ **tokenExpirationMonth** ↳ **tokenExpirationYear** | Parameters which provide the tokenized values for digitized card.                                               |
| ↳ **paymentAccountReference**                        | Non-transactable value that is paired with a FPAN and is linked to any token created that represents that FPAN. |
| **dynamicData** object                               | A cryptogram object.                                                                                            |
| ↳ **dynamicDataValue**                               | Containing the 32 char DSRP cryptogram in base64.                                                               |
| ↳ **dynamicDataType**                                | `CARD_APPLICATION_CRYPTOGRAM_SHORT_FORM` indicates DSRP.                                                        |
| **srcTokenResultsData** object                       | Additional token data.                                                                                          |
| ↳ **tokenRequesterId**                               | Token Requester identifier.                                                                                     |
| ↳ **unpredictableNumber**                            | Unpredictable Number used to generate this cryptogram.                                                          |

Once the Mastercard Checkout Solution receives the payload response for a tokenized payment, they can proceed to make a payment authorization with their acquirer or payment provider.