# Set Up Project Resources
source: https://developer.mastercard.com/mastercard-threat-intelligence/tutorial/api-sandbox-guide/step-3/index.md

In this step, you add three resources to `src/main/resources/`: the OpenAPI specification, your signing key, and a configuration file.

*** ** * ** ***

### Add the OpenAPI Specification {#add-the-openapi-specification}

Copy the
[mastercard-threat-intelligence-api.yaml](https://static.developer.mastercard.com/content/mastercard-threat-intelligence/swagger/mastercard-threat-intelligence-api.yaml) (66KB) file into `src/main/resources/`. The build uses this file to generate the API client in a later step.

*** ** * ** ***

### Add the Signing Key {#add-the-signing-key}

Copy your PKCS#12 keystore into `src/main/resources/`. This tutorial expects a file named `mti-api-signing.p12`.
Alert: Keeping the key on the classpath makes the demo easy to run. For a real application, store the key outside the code and load it from a secure location.

*** ** * ** ***

### Add the Configuration File {#add-the-configuration-file}

Create a file named `application.properties` in `src/main/resources/`. This file holds all environment settings, so you can switch environments without changing code.

Add the following content. Replace each placeholder with your own value:

```properties
# Base URL for the MTI API
mti.api.base-url=https://sandbox.cyber.mastercard.com

# OAuth 2.0 token endpoint and issuer
mti.oauth.token-url=https://sandbox.api.mastercard.com/oauth/token
mti.oauth.issuer=https://sandbox.api.mastercard.com

# Client credentials
mti.oauth.client-id=YOUR_CLIENT_ID
mti.oauth.key-id=YOUR_KEY_ID

# Signing key (PKCS#12 keystore on the classpath)
mti.oauth.keystore=mti-api-signing.p12
mti.oauth.keystore-password=YOUR_KEYSTORE_PASSWORD
mti.oauth.key-alias=YOUR_KEY_ALIAS

# Access scopes (space-separated)
mti.oauth.scopes=mc-threat-intelligence:card-testing_read mc-threat-intelligence:domains_read mc-threat-intelligence:vulnerabilities_read
```

*** ** * ** ***

### Understand the Settings {#understand-the-settings}

The table below describes each setting:

|            Setting            |                    Description                    |
|-------------------------------|---------------------------------------------------|
| `mti.api.base-url`            | The base URL for the API environment.             |
| `mti.oauth.token-url`         | The OAuth 2.0 endpoint that issues access tokens. |
| `mti.oauth.issuer`            | The token issuer that matches the environment.    |
| `mti.oauth.client-id`         | Your client ID from Mastercard Developers.        |
| `mti.oauth.key-id`            | The key ID that identifies your signing key.      |
| `mti.oauth.keystore`          | The keystore file name on the classpath.          |
| `mti.oauth.keystore-password` | The password for the keystore.                    |
| `mti.oauth.key-alias`         | The alias of the key inside the keystore.         |
| `mti.oauth.scopes`            | The access scopes granted to your project.        |

You reference these settings from your Java code in a later step.

*** ** * ** ***