# API Basics
source: https://developer.mastercard.com/merchant-identifier/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses [OAuth 1.0a with body hash extension](https://oauth.net/core/1.0a/) for authenticating the API clients. This requires every request
you send to Mastercard to be signed with an RSA private key. A private-public RSA key pair must be generated consisting
of:

1. A **private key** for the OAuth signature for API requests. It is recommended to keep the private key in a password-protected or hardware keystore.   
2. A **public key** is shared with Mastercard during the project setup process through either a certificate signing request (CSR) or the API Key Generator. Mastercard will use the public key to verify the OAuth signature provided on every API call.

Requests with a body must be signed using the Google request body hash extension for OAuth.
The OAuth Keys for your project can be set up on your project dashboard here ([Developer Dashboard](https://developer.mastercard.com/dashboard)) after you create a project.
Tip: Do you want to learn more about the authentication scheme Mastercard uses? For that, read our [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) guide.

### Transport Encryption {#transport-encryption}

The transport between client applications and Mastercard is secured using [TLS/SSL](https://en.wikipedia.org/wiki/Transport_Layer_Security),
which means data are encrypted by default when transmitted across networks. Mastercard's encryption scheme is typically used for encrypting sensitive data such as personal identifiable information (PII). Payload encryption is not required for this API.

## How to Consume the API? {#how-to-consume-the-api}

### Generating your own Merchant Identifier API client {#generating-your-own-merchant-identifier-api-client}

Create customizable API clients from the Merchant Identifier API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers more flexibility and is strongly recommended.

To learn how to generate your own client, please follow our guide: [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with the following [Merchant Identifier API specification file](https://static.developer.mastercard.com/content/merchant-identifier/swagger/merchantidentifier-v3.yaml).

## Environments {#environments}

### Sandbox {#sandbox}

The Merchant Identifier API Sandbox is an environment that mirrors the production environment. It is a shared environment that everyone who creates a project has access to. All data in the sandbox is test data but representative of what is available in production, it is useful to understand the structure, and nature, of the data that is available with the service.

All endpoints, and data elements are available in Sandbox by default, and it is free to use. The only limitation is that the data is entirely mocked and cannot be used in production solutions.

#### Base URL for Sandbox endpoint {#base-url-for-sandbox-endpoint}

* Sandbox

```Sandbox
https://sandbox.api.mastercard.com/merchant-identifier
```

### Production {#production}

To learn about the end-to-end process to move from Sandbox to Production see [Move to Production](https://developer.mastercard.com/merchant-identifier/documentation/quick-start-guide/index.md#go-live) guide. We are offering a free trial of the Merchant Identifier API before requesting production access to initiate the contracting process in parallel with your other onboarding steps.

#### Base URL for Production endpoint {#base-url-for-production-endpoint}

* Production

```Production
https://api.mastercard.com/merchant-identifier
```

## Next Steps {#next-steps}

### API Status {#api-status}

The Merchant Identifier API uses synthetic monitoring to continuously verify that the API is available and functioning as expected. This information is publicly available, allowing you to check up-time and review any recent issues. Check the [Status Page](https://developer.mastercard.com/api-status?environment=production&service=Merchant%20Identifier) to view this information.

### Developer Tooling {#developer-tooling}

We provide a set of developer tools to help you integrate with the API more easily and get the most value from the account range data. These tools give you a head start when building your connection. For details, see [Developer Tools](https://developer.mastercard.com/merchant-identifier/documentation/developer-tools/index.md)