# Mastercard Processing - Mastercard Services
source: https://developer.mastercard.com/mastercard-processing-mastercard/documentation/index.md

## Overview {#overview}

Mastercard Processing - Mastercard Services is a companion API for PAN-less issuers. These issuers operate without storing or handling full Primary Account Numbers (PANs).

It enables these issuers to integrate with Mastercard program APIs that require a PAN in the request, such as Carbon Calculator, while ensuring that the PAN is never exposed to issuer systems.

**Prerequisites**

Before using this API, ensure that:

* The issuer is a Mastercard Processing customer and issues cards through Mastercard Processing Core APIs.
* The issuer is onboarded to the target Mastercard program API.
* During onboarding, the issuer generates a Client Encryption Key. This is a public RSA key created in Mastercard Developers within the project associated with that program.  

**High-level process**

* **Input:** A payload required by the target Mastercard program API (without the PAN), enriched with:
  * The `cardContractId` (the Mastercard Processing Card Management System (CMS) technical identifier for the card). It represents the card issued with the Mastercard Processing Core API.
  * The issuer's Client Encryption Key generated during program onboarding.
* **Process:** Mastercard Processing securely retrieves the PAN using the `cardContractId` and combines it with the issuer-provided payload. The combined data is then encrypted using the issuer‑supplied RSA key.
* **Output:** A JWE-encrypted structure containing both the PAN and the provided payload.
* **Usage:** The issuer forwards this encrypted payload directly to the target Mastercard program API, ensuring Payment Card Industry (PCI) compliance and secure downstream integration.  

**Value proposition**

* **Downstream Enablement:** Issuers integrate with Mastercard programs, such as Carbon Calculator, without storing or handling PANs.
* **Security by design:** The PAN is retrieved only inside Mastercard Processing and encrypted into a **JSON Web Encryption (JWE)** payload using the target Mastercard program's public encryption key.  
  The issuer never has access to the PAN. Only the target Mastercard program holds the corresponding private encryption key and can decrypt the payload.
* **Operational simplicity:** A single API endpoint returns all the encrypted data required for registration in downstream Mastercard programs.

Note: The Mastercard Processing product page can be found [here](https://developer.mastercard.com/product/mastercard-processing/).

## How it Works {#how-it-works}

![How it works diagram](https://static.developer.mastercard.com/content/mastercard-processing-mastercard/uploads/doc-how-it-works.jpg)
* **Cardholder:** The end user who orders a payment card and later views sustainability information through the issuer application.
* **Issuer App:** The mobile or web interface used by the cardholder to order a card and access carbon impact data.
* **Issuer Middleware:** The backend system that orchestrates API calls between the issuer app, Mastercard Processing APIs, and Mastercard program APIs.
* **Mastercard Processing (MP) Core APIs:** The Mastercard Processing Card Management System (CMS) interface responsible for card issuance and management of all product families.
* **Mastercard Processing (MP) Mastercard Services API:** A Mastercard Processing value‑added service that generates a secure, encrypted payload for the Carbon Calculator `service-providers/payment-cards` endpoint. It does this using only the card's technical identifier `cardContractId` assigned during issuance by the Mastercard Processing Core APIs.
* **Mastercard Carbon Calculator API:** The Mastercard program API that registers cards and calculates carbon emissions based on card activity.
* **Seamless integration for PAN‑less issuers:** Enables Mastercard Processing PAN-less issuers to integrate with Mastercard program APIs, such as the Carbon Calculator, without handling or exposing the full PAN, thereby maintaining PCI compliance and ensuring data security.
* **Future‑ready integration model:** Provides a scalable and secure pattern that supports future Mastercard program integrations for non-PCI-compliant issuers issuing cards through the Mastercard Processing CMS.  

For detailed examples of how Mastercard Processing - Mastercard Services can be used, explore the [Use Cases](https://developer.mastercard.com/mastercard-processing-mastercard/documentation/use-cases/index.md) section.

## Good to Know {#good-to-know}

> * **Onboarding information:** To onboard, create an account on [Mastercard Developers](https://developer.mastercard.com/) and activate your Sandbox and Production project credentials. Access to MTF and Production environments requires completion of a **CIS-managed onboarding project**, which enables the required APIs after your Mastercard Developers credentials are set up.
> * **Testing information:** You can test Sandbox API calls using the [Open Sandbox](https://developer.mastercard.com/mastercard-processing-mastercard/documentation/testing/index.md).
> * **Batch processing:** The Mastercard Processing - Mastercard Services does not support [batch processing](https://aws.amazon.com/what-is/batch-processing/#:~:text=Batch%20processing%20is%20the%20method,run%20on%20individual%20data%20transactions.).
> * **Region availability/border control:** Mastercard Processing is available in the EMEA region.
Note: New countries may be added based on demand, subject to Mastercard legal and compliance checks.

## Next Steps: {#next-steps}

Now that you have an understanding of what the service does, proceed to the [API Basics](https://developer.mastercard.com/mastercard-processing-mastercard/documentation/api-basics/index.md) section for details on authentication and encryption.