# Add Signing Key
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/add-signing-key/index.md
## 1. Add Signing Key {#1-add-signing-key}
The **Key Management** tab on the Mastercard Checkout Solutions onboarding application allows you to add and download API signing keys for use on both the Sandbox and Production environments.
Tip: The API Signing Key (OAuth key) and Consumer Key are auto-generated in Sandbox (Mastercard Checkout Solutions - Sandbox). It is advisable to start with the auto-generated keys in the Sandbox before proceeding to adding your keys in the Production environment.
Two options are available when adding your API Signing Key:
* [Option 1: Adding keys using the browser keystore](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/add-signing-key/index.md#option-1-adding-keys-using-the-browser-keystore)
* [Option 2: Using a Certificate Signing Request](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/add-signing-key/index.md#option-2-using-a-certificate-signing-request)
### Option 1: Adding keys using the browser keystore {#option-1-adding-keys-using-the-browser-keystore}
1. Access the Mastercard Checkout Solutions onboarding application on Mastercard Connect.
2. Navigate to **Key Management** tab.
3. Click **Add Key** in the API Signing Key (OAuth key) section.
4. Provide a Key Alias and Keystore Password and click **Add** . 
* Your browser generates a key pair and a Certificate Signing Request (CSR).
* The browser keystore secures the private key and then forwards the public key via CSR to Mastercard.
* Mastercard signs this key and sends it back as a X509 certificate.
* Upon receiving this certificate, your browser generates a PKCS#12 keystore.
5. Your browser automatically downloads this PKCS#12 keystore as a file suffixed with ".p12".
* The P12 keystore you generate contains a public/private key secured with the passphrase (Keystore Password) you added. The public key is shared with Mastercard during the generation process and will be used to verify the OAuth signature provided on every API call. The OAuth signature must be created using the private key inside the P12 keystore.
#### View the contents of the keystore: {#view-the-contents-of-the-keystore}
During key generation, you will give the P12 keystore a ***filename, password*** and ***alias*** (friendly name). So for example:
* Filename: `srctest-sandbox`
* Password: `keystorepassword`
* Private key alias (friendly name): `keyalias`
To view the contents of the keystore you can use the following commands, either in Java Keytool or OpenSSL
* OpenSSL
* Javakeytool
```OpenSSL
openssl pkcs12 -info -in srctest-sandbox.p12 -password pass:keystorepassword
```
```Javakeytool
keytool -storetype PKCS12 -list -keystore srctest-sandbox.p12 -storepass keystorepassword -v
```
Note: Always keep your private keys safe, ideally in a password-protected or hardware keystore. If you lose this file you should revoke the corresponding key and generate a new one.
### Option 2: Using a Certificate Signing Request {#option-2-using-a-certificate-signing-request}
You can manually upload a Certificate Signing Request (CSR) generated in your system. A CSR is an encoded file that provides a standardized way to send a public key as well as some information that identifies your company and domain name. This method will keep your private key secure, at no time will Mastercard see it or be able to recover it.
Note: Once you upload your CSR file, Mastercard sets a default 364 day expiry period for the API Signing certificate.
Mastercard will sign your certificate and your validated public certificate and generates a Consumer Key. This validated public certificate is the one that Mastercard will use to check your OAuth headers on your API requests.
Before you can add new keys, you will need to generate a CSR from your Certificate Authority server. When you generate a CSR, you will be asked for the following information:
* Country (C): The two-letter code for the country where your organization is located. For example, `BR`.
* State/County/Region (ST): The state/region where your organization is located. This shouldn't be abbreviated. For example, `Brazil`.
* Locality Name (L): The city where your organization is located. This should not be abbreviated. For example, `Curitiba`.
* Organizational Unit (OU): The division of your organization handling the certificate. For example, `IT`.
* Common Name (CN): The fully qualified domain name (FQDN) of your server or the host where you intend to use the certificate.For example, `yourdomain.com`. This is a required field.
* Email Address: An email address we can use to contact you, usually of the certificate administrator or IT department. For example, `CA@yourdomain.com`.
* Key type: Mastercard uses RSA.
* Key size: The size is 2048 bits.
When your CSR is ready, you'll need to upload it using the Add Key button.
You will need to add the key alias you used in your key generation step.
### Commands {#commands}
The CSR itself should be generate in Base-64 PEM format. You can open the CSR file using a simple text editor and it will look like the samples below.
#### Example using OpenSSL {#example-using-openssl}
Use the following command to create a private key and public certificate
* OpenSSL
$ ls cacert.pem cakey.pem readme.txt "\>
```OpenSSL
$ openssl req -newkey rsa:2048 -x509 -keyout cakey.pem -out cacert.pem
Generating a RSA private key
.+++++
..+++++
writing new private key to 'cakey.pem'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
### You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank. {#if-you-enter-3939-the-field-will-be-left-blank}
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgets Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
`$ ls
cacert.pem cakey.pem readme.txt
`
```
In the above command :
* `req` option means you are creating a Certificate Request (pkcs10)
* `-newkey rsa:2048` means you are generating a new RSA key of 2048 bits in size
* `-x509` means you are outputting an x509 structure instead of a cert req
* `-keyout cakey.pem` is the private key
* `-out cacert.pem` is the public certificate
#### Use the following commands to create a PKCS12 file: {#use-the-following-commands-to-create-a-pkcs12-file}
* OpenSSL
```OpenSSL
openssl pkcs12 -export -in cacert.pem -inkey cakey.pem -out identity.p12 -name "keyalias"
Enter pass phrase for cakey.pem:
Enter Export Password:
Verifying - Enter Export Password:
```
In the above command:
* `-name` is the alias of the private key entry in keystore.
* `Export Password` is the Keystore password provided to access the .p12 file.
#### Use the following commands to create a CSR file: {#use-the-following-commands-to-create-a-csr-file}
* OpenSSL
$ ls cacert.pem cakey.pem certreq.csr
"\>
```OpenSSL
openssl req -out certreq.csr -key cakey.pem -new
Enter pass phrase for cakey.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:ad
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
`$ ls
cacert.pem cakey.pem certreq.csr`
`
`
```
#### Use the following command to check the CSR: {#use-the-following-command-to-check-the-csr}
* OpenSSL
```OpenSSL
$ openssl req -in certreq.csr -noout -text
```
To know more about the requirements your CSR must meet, refer to [Mastercard Requirements for CSRs](https://developer.mastercard.com/platform/documentation/security-and-authentication/csr-requirements/).