# API Keys source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md To integrate with Mastercard Checkout Solutions, you will need the following keys: | Key | Purpose | Description | |---------------------------------|----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **API Signing Key (OAuth key)** | Authenticate API calls | * API Signing Key is a 2048-bit or 4096-bit private RSA key required to authenticate your API calls. * When you call Mastercard APIs you will need to include an OAuth1.0a Authentication header in your request. You use the private part of the API Signing Key to generate the OAuth header so that the Mastercard API server can authenticate your access to the APIs. * This private key is part of a public/ private key pair generated by you (or your web browser) and whose public key is certified by Mastercard. It is provided in a [PKCS #12](https://tools.ietf.org/html/rfc7292) format key store file, with a .p12 suffix, and password protected. * To get started, you can access the default API Signing Key from Mastercard Checkout Solutions onboarding application on Mastercard Connect. * Follow these steps to [create the API Signing Key](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/add-signing-key/index.md) on Mastercard Connect. Tip: Learn how [Mastercard authenticates your requests and provides access to the APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) | | **Consumer Key** | Identifies the client application and is required to calculate the OAuth header. | * The API Signing Key and the Consumer Key are collectively referred to as the OAuth key. * [Consumer Key](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#the-consumer-key) is generated along with the API Signing Key. * The Consumer Key appears in the OAuth1.0a authorization header sent with each request. * Consumer Keys are 97 character identifiers for client applications consuming Mastercard APIs. * The first 48 characters (before the exclamation mark) of the consumer key represent the Client ID. The last 48 characters (after the exclamation mark) of the consumer key represent the Key ID (KID). Note: The Key ID portion of the Consumer Key changes whenever the API Signing Key is modified. | | **Payload Encryption Key** | Payload encryption for payment credentials security | * Encryption involves 2048-bit or 4096-bit RSA public/private key pairs. * Mastercard uses the public part of this encryption key to [encrypt response payloads containing payment card credentials](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/). * Merchants or PSPs will need the corresponding private part to decrypt these payloads. * Follow these steps to [upload Encryption Key](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/add-encryption-key/index.md) on Mastercard Connect. * Mastercard Checkout uses Field Level Encryption to provide end-to-end payload encryption to secure sensitive data like Personally Identifying Information (PII). Tip: To learn more about encryption schemes that Mastercard uses, refer to [Securing Sensitive Data Using Payload Encryption](https://developer.mastercard.com/platform/documentation/security-and-authentication/securing-sensitive-data-using-payload-encryption/). | ## Public Keys Mastercard Provides {#public-keys-mastercard-provides} Mastercard generates two keys for the following purposes. | Name | Purpose | Description | |------------------------------|-------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Payload Verification Key** | Authenticate the source of payload. | Alongside encrypting the payload with your public \[Payload\] Encryption Key (detailed in the previous table), Mastercard signs it using the private part of this Payload Verification Key. During payload signature verification Integrator uses the corresponding public part to verify if the payload has come from Mastercard. You can identify the correct verification key through the header of the JWS signature containing a KID that corresponds to a public key on the **payloadVerification** URL. These keys can be stored in your cache for up to 10 days to ensure that the current and future keys are available during key rotation. | | **FPAN Encryption Key** | Protect FPANs in transit. | During card enrollment, you must encrypt card objects and enrollmentData objects containing the FPANs before transmitting to Mastercard. You can encrypt them using this public key. Mastercard will then decrypt using the private part. During encryption, obtain the key from the fpanEncryption URL and include the corresponding KID in the header of your JWE object. This key can be stored in cache for up to 10 days to ensure the latest key is available during key rotation. View the [Card Encryption](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/perform-encryption/index.md) tutorial for details. | Fetch the most up-to-date public keys (in a JWK format) via the following Mastercard URLs. | Environment | URLs | |-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Sandbox | * Payload Verification Key: * FPAN Encryption Key: | | Production | * Payload Verification Key: * FPAN Encryption Key: | Refer to [JSON Web Key RFC](https://tools.ietf.org/html/rfc7517) for a definition of the format of this JSON object. The Key ID Parameter (kid) shows the purpose of each key. Note: You must work with your [Mastercard representative](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/support/index.md#get-help) for required keys and certificates to receive notifications from Outbound API endpoints. Refer to [API Reference](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/index.md) section for more details.