# August 2026 Release Notes
source: https://developer.mastercard.com/mdes-token-connect/documentation/pre-release-notes/prereleasenote_august2026/index.md

## Release Change Summary {#release-change-summary}

Mastercard has deprecated support for the RSA PKCS#1 v1.5 encryption scheme and transitioned to RSA-OAEP as the supported payload encryption scheme. This transition enhances security by leveraging the RSA-OAEP encryption scheme which provides stronger security protection and improved resilience against evolving threats.

##### Impacted APIs {#impacted-apis}

* Push Multiple Accounts

## Release Timeline {#release-timeline}

* MTF - Deprecated encryption support until 31st March 2027
* Production - Deprecated encryption support until 31st March 2027

### Impacted Market {#impacted-market}

* Functionality Available - Global

## Change 1 - Deprecated the RSA PKCS#1 v1.5 encryption {#change-1---deprecated-the-rsa-pkcs1-v15-encryption}

As part of this change, the references to the PKCS#1 v1.5 encryption scheme have been removed from the `encryptedKey` parameter.

## Change 2 Mandated the OAEP Hashing Algorithm {#change-2-mandated-the-oaep-hashing-algorithm}

The `oaepHashingAlgorithm` parameter is now mandatory within the `encryptedPayload` object and must be configured according to the customer's configured value. Supported values are:

* SHA256
* SHA512


API Reference: `GET /connect/{maj}/pushMultipleAccounts`

## Impact {#impact}

### Existing Customers {#existing-customers}

Existing customers must update their integrations to use RSA OAEP as the encryption and decryption mechanism for payloads in both API requests and responses. After implementing and validating RSA-OAEP support, customers must submit a request through the [Support Case Management](https://www.mastercardconnect.com/case-mgmt/) application to update their configuration.

###### Error Details {#error-details}

If a customer continues to use RSA PKCS#1 v1.5 encryption scheme for request payloads after 31 March 2027, the requests may be rejected by Mastercard with a `CRYPTOGRAPHY_ERROR` or a more specific
error such as `MISSING REQUIRED FIELD -- oaepHashingAlgorithm`.

###### Testing {#testing}

Mastercard recommends customers test their implementation with the RSA-OAEP encryption scheme in MTF. Customers must adopt the RSA-OAEP encryption scheme to align with the Production timeline.

### New Customers {#new-customers}

New customers must follow the updated configuration requirements before using this functionality. Refer to the API specification for details.

## Additional Updates {#additional-updates}

Deprecated /pushAccount endpoint has been removed from the [API Reference](https://developer.mastercard.com/mdes-token-connect/documentation/api-reference/index.md) section.

### Personal data and Privacy Note {#personal-data-and-privacy-note}

Issuers are reminded that the information presented via the Token Connect includes personal data which is subject to data privacy laws. Issuer must satisfy themselves that the processing of such personal data is compliant with applicable privacy laws.