# Encyrpt a Card
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/perform-encryption/step2/index.md

## Step 2: Encyrpt a Card {#step-2-encyrpt-a-card}

Encryption involves 2048-bit RSA public/private key pairs. A FPAN encryption key (`src-fpan-encryption`) is a public key that Mastercard provides to protect FPANs in transit. Data encrypted using a public key can only be decrypted using the corresponding private key.

To encrypt a card,

1. Access the updated public keys from the following URLs:   

| Environment |                                                                                       URLs                                                                                        |
|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox     | * Payload Verification Key: <https://sandbox.src.mastercard.com/keys/mcs/payloadVerification> * FPAN Encryption Key: <https://sandbox.src.mastercard.com/keys/mcs/fpanEncryption> |
| Production  | * Payload Verification Key: <https://src.mastercard.com/keys/mcs/payloadVerification> * FPAN Encryption Key: <https://src.mastercard.com/keys/mcs/fpanEncryption>                 |

Refer to [Public Key Mastercard Provides](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md#public-key-mastercard-provides) for more details.

2. Format your `card` object as shown in the below example:

   ```json
   {
       "primaryAccountNumber":"5299920971401623",
       "panExpirationMonth":"08",
       "panExpirationYear":"2031",
       "cardSecurityCode":"000"
   }
   ```

   <br />

3. Import the following Java packages:

   * com.nimbusds.jose.EncryptionMethod
   * com.nimbusds.jose.JOSEException
   * com.nimbusds.jose.JWEAlgorithm
   * com.nimbusds.jose.JWECryptoParts
   * com.nimbusds.jose.JWEEncrypter
   * com.nimbusds.jose.JWEHeader
   * com.nimbusds.jose.JWEObject
   * com.nimbusds.jose.crypto.RSAEncrypter
   * com.nimbusds.jose.jwk.RSAKey
   * java.nio.charset.Charset
   * java.text.ParseException

   <br />

4. Create a public class and include the main method. Use the `nimbus-jose-jwt` library for creating the JWE token.

   ```java
   public class JWEEncryptor {

       public static final String KID = "20230207223521-sandbox-fpan-encryption-src-mastercard-int";

       public static final String PAYLOAD = "{\"primaryAccountNumber\":\"5455031247681061\","
           + "\"cardSecurityCode\":\"123\","
           + "\"panExpirationMonth\":\"11\",\"panExpirationYear\":\"2024\"}";

       public static final String PUBLIC_KEY = "{\n" +
           "  \"kty\": \"RSA\",\n" +
           "  \"x5t#S256\": \"NgYAgjb6lJhuCqoB-3aIPc7km_QvU5nM65xdmxp2bFk\",\n" +
           "  \"e\": \"AQAB\",\n" +
           "  \"use\": \"enc\",\n" +
           "  \"kid\": \"20221214224510-mtf-mc-srci-card-encryption-mtf-srci-mastercard-int\",\n" +
           "  \"x5c\": [\n" +
               "    \"MIIF5zCCA8+gAwIBAgIIDzMLWnXusKEwDQYJKoZIhvcNAQELBQAwgbgxEzARBgoJkiaJk/IsZAEZFgNjb20xGjAYBgoJkiaJk/IsZAEZFgptYXN0ZXJjYXJkMQswCQYDVQQGEwJCRTEdMBsGA1UEChMUTWFzdGVyQ2FyZCBXb3JsZHdpZGUxGzAZBgNVBAsTEkNvcnBvcmF0ZSBTZWN1cml0eTE8MDoGA1UEAxMzTWFzdGVyQ2FyZCBQUkQgQXBwbGljYXRpb24gSW5mcmFzdHJ1Y3R1cmUgU3ViIENBIEcyMB4XDTIzMDIwNzIxMzc0M1oXDTI1MDUxMzIyMjM0M1owga8xMzAxBgNVBAMMKnNhbmRib3gtZnBhbi1lbmNyeXB0aW9uLXNyYy5tYXN0ZXJjYXJkLmludDEMMAoGA1UECwwDc3JjMTQwMgYDVQQKDCtNYXN0ZXJDYXJkIFdvcmxkV2lkZSAtIENvbW1vbiBQcm9kSW5mcmEgU1NMMRQwEgYDVQQHDAtTYWludCBMb3VpczERMA8GA1UECAwITWlzc291cmkxCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAt06I8sjlS+rrs7uCagH8evoeumaRovKziZSI9S2N9IDQ9tW2PapfRa9Lc1KveEBDVs27PkhkU5OyHgP0iEjTuKVpvh59T4la+mBSIls7UecUQLLa0WkmbtL7jNdltA5fq7AhcAr5qca988qrLd7Iyr9E0C3TxbT9to1iQcpz8ocZODRXoidFAnOVL5YGFmlsreDbJ4Vhsi0pAdccQcil+ydSgurKB+rqKppb9epomu4QUh3382Cv8NobYmF3os8nGGgGP+cyXo0nsKcPAgfrlQzos7qHxUOrFe2x/lZ1G1AE+XrkrxjBys9q53GMRSNCQ8c+/mcF9pbq4HYBs+vD5QIDAQABo4H7MIH4MA4GA1UdDwEB/wQEAwIAMDAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBT80oMEkaLWiwM+0W5Wi8Rx7Z7IqjAfBgNVHSMEGDAWgBRLoKIgrzLwZl3LGXmYmLJs5e0n1DBhBgNVHR8EWjBYMFagVKBShlBodHRwOi8vY3JsZHAuZWNtcy5tY2xvY2FsLmludDoxMzUzNi80YmEwYTIyMGFmMzJmMDY2NWRjYjE5Nzk5ODk4YjI2Y2U1ZWQyN2Q0LmNybDA1BgNVHREELjAsgipzYW5kYm94LWZwYW4tZW5jcnlwdGlvbi1zcmMubWFzdGVyY2FyZC5pbnQwDQYJKoZIhvcNAQELBQADggIBAG7aXg4bmIQxMcxzLnKjxn0S1rmoLm+LYyMpBHISVoANCv81w888nW5hghRocYWsyDUIR3dXkKUEdLjh7qdTz5unlenhwEUOe3qYu1MzNcxLHLngltiiOqbDHYPb+qwCYZ8wR/O7nY0Xl3OhHHMbH8s0JsDtA0ae7kYz4m/apfrQe9L8O3NMXPdGQoX0m4qUTgs8DzSzkuqWdmi9XLInsofq8n/5Vc541sCOb6Qxvlf2G3lswIIuf0aCr92indfOiwDHN542rvIH6em4/dYAUfsfed/cvZa2T5kAdHxBS/CqNxBdKdReg3//FatLRoGB1SvD2l9JNycTBUKWIC/gwaHFFXIX42u+Jh4cQIPx+IvlDTYqi7nBYuRr8HV/kkj1Q9k2laS16tg+nn1II3RJl7I/aLz5BoaK1AQGUVQ95eIpjiy31vCg5QuLNTET1HCVvqkcst23f/ZE+yBDM6H+XQywp18+b38RCC+bOL8A6b8QUtSo7AcAh4Kygtxry9zU3J8rgkeqtj+00H/5e1ZvxHI75CMnZaLtMhO9mnuTB+maOeFPa45VYK8iU8oGSYui6fIunw/0FQhkaAgXWbUTcyRy4pCyH3jQFa6MmpaJhh5lbdynK9pbMEjMZ86P6InbUNgGhUZ2fYg0HUUTfwn1ChE4es4dzjgzbnoBvv0l0iT7\"\n" +
               "  ],\n" +
               "  \"key_ops\": [\n" +
               "    \"encrypt\",\n" +
               "    \"wrapKey\"\n" +
               "  ],\n" +
               "  \"alg\": \"RSA-OAEP-256\",\n" +
               "  \"n\": \"t06I8sjlS-rrs7uCagH8evoeumaRovKziZSI9S2N9IDQ9tW2PapfRa9Lc1KveEBDVs27PkhkU5OyHgP0iEjTuKVpvh59T4la-mBSIls7UecUQLLa0WkmbtL7jNdltA5fq7AhcAr5qca988qrLd7Iyr9E0C3TxbT9to1iQcpz8ocZODRXoidFAnOVL5YGFmlsreDbJ4Vhsi0pAdccQcil-ydSgurKB-rqKppb9epomu4QUh3382Cv8NobYmF3os8nGGgGP-cyXo0nsKcPAgfrlQzos7qHxUOrFe2x_lZ1G1AE-XrkrxjBys9q53GMRSNCQ8c-_mcF9pbq4HYBs-vD5Q\"\n" +
                   "}";

       public static void main(String[] args) throws ParseException, JOSEException {
           //generate key by parsing your public key
           RSAKey key = RSAKey.parse(PUBLIC_KEY);
           //define JWE header
           JWEHeader header = new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A128GCM).keyID(KID).build();
           // Create an RSA encrypted with the specified public RSA key
           JWEEncrypter joseRsaEncryptor = new RSAEncrypter(key);
           // Initialized the JWECryptoParts object
           JWECryptoParts jweCryptoParts = joseRsaEncryptor.encrypt(header, PAYLOAD.getBytes(Charset.defaultCharset()));
           // Doing the actual encryption
           JWEObject jweObject = new JWEObject(header.toBase64URL(), jweCryptoParts.getEncryptedKey(),
               jweCryptoParts.getInitializationVector(),
               jweCryptoParts.getCipherText(), jweCryptoParts.getAuthenticationTag());
           // Serialize to JWT compact form
           String jwtString = jweObject.serialize();
               printIt(jwtString);
           }
       private static void printIt(String jwtString) {
           System.out.println("");
           System.out.println("========================= Encrypted JWE token ==================================");
           System.out.println("");
           System.out.println("\n JWE token : " + jwtString);
           System.out.println("");
       }
   }
   ```

   <br />

   Note: In the above code sample,
   * `PUBLIC_KEY` and `PAYLOAD` are required parameters to perform encryption.   
   * For `PUBLIC_KEY` parameter, ensure to use the updated public key value from the URLs mentioned in [Step 1](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/perform-encryption/step2/index.md#step-2-encyrpt-a-card).
5. Encrypt your object using the above details. Pass the encrypted value in `encryptedCard` parameter during [Enroll Card](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) API or `digitalAccountReferenceValue` in [Guest Checkout](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#checkout) API call.