# Offers for Publishers (Legacy) OAuth 2.0 authentication and first call
source: https://developer.mastercard.com/pclo-presentment/documentation/tutorials-and-guides/offers-publishers-legacy-auth-first-call-tutorial/index.md

## Introduction {#introduction}

This tutorial describes how to install and configure the Mastercard Insomnia plugin, set up OAuth 2.0 authentication, and send your first successful Offers for Publishers (Legacy) request.

## Tutorial prerequisites {#tutorial-prerequisites}

To complete this tutorial, you will need:

* Insomnia installed on your local machine.
* Mastercard Insomnia plugin installed in Insomnia.
* Access to the Offers for Publishers (Legacy) Reference, including the OpenAPI specification file.
* A Mastercard Developers Portal account with access to the Offers for Publishers (Legacy).
* OAuth 2.0 credentials from the Mastercard Developers Portal:
  * Client ID
  * Key ID (kid)
  * OAuth scopes
  * Authentication key provided as a `.p12` keystore file, including its alias and password
* Access to a Sandbox or Production environment, depending on where you are testing.

## Install and configure Insomnia {#install-and-configure-insomnia}

### Steps {#steps}

1. Install Insomnia from [here](https://github.com/Mastercard/insomnia-plugin-mastercard/blob/main/README.md#installation-).

2. Configure your Insomnia automatically [here](https://github.com/Mastercard/insomnia-plugin-mastercard/blob/main/README.md#configuration-).

### Environment configuration notes {#environment-configuration-notes}

* Use the correct values according to the environment.
* Keep only one authentication mode configured at a time (OAuth 2.0 or OAuth 1.0).

<br />

OAuth 2.0 token endpoint URL
* Sandbox
* Production

```Sandbox
https://sandbox.api.mastercard.com/oauth/token
```

```Production
https://api.mastercard.com/oauth/token
```

Authorization server issuer URL
* Sandbox
* Production

```Sandbox
https://sandbox.api.mastercard.com
```

```Production
https://api.mastercard.com
```

<br />

## Update required values {#update-required-values}

### Prerequisites {#prerequisites}

For this step, you will need the following information from the Mastercard Developers portal:

* Client ID
* Key ID (kid)
* Scopes
* Authentication Key (`.p12` keystore file with its alias and password)

![alt text](https://static.developer.mastercard.com/content/pclo-presentment/uploads/mastercard-developers-portal-pclo.png "Mastercard Developers Portal")

### Steps {#steps-1}

1. Update the following values in your environment.

|      Value       |                                                                   Description                                                                    |
|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| clientId         | OAuth 2.0 client identifier.                                                                                                                     |
| kid              | Key ID of the client authentication key.                                                                                                         |
| keystoreP12Path  | Absolute path to the P12 keystore file.                                                                                                          |
| keyAlias         | Key alias within the P12 keystore.                                                                                                               |
| keystorePassword | Password for the P12 keystore.                                                                                                                   |
| tokenEndpoint    | OAuth 2.0 token endpoint URL. - Sandbox: <https://sandbox.api.mastercard.com/oauth/token> - Production: <https://api.mastercard.com/oauth/token> |
| issuer           | Authorization server issuer URL. - Sandbox: <https://sandbox.api.mastercard.com> - Production: <https://api.mastercard.com>                      |
| scopes           | Array of OAuth scopes to request.                                                                                                                |

## Configure and send an API request {#configure-and-send-an-api-request}

### Option 1: Auto configuration {#option-1-auto-configuration}

1. Select a simple read endpoint from the [User Presentment API Reference](https://developer.mastercard.com/pclo-presentment/documentation/api-reference/user-presentment/) page.

#### Example from Offers for Publishers Legacy API: {#example-from-offers-for-publishers-legacy-api}

* POST /access-tokens
* Set the base url/domain for Sandbox: <https://sandbox.api.mastercard.com/loyalty/offers/user-presentment>
* Set the base url/domain for Production: <https://sandbox.api.mastercard.com/loyalty/offers/user-presentment>

2. Copy the respective payload from the [User Presentment API Reference](https://developer.mastercard.com/pclo-presentment/documentation/api-reference/user-presentment/) page.

#### Sample request URL: {#sample-request-url}

<https://sandbox.api.mastercard.com/loyalty/offers/user-presentment/access-tokens>

3. Build the request in Insomnia:

* Create a new POST request with your endpoint URL.
  * Send right values for fiId, userId, and utcOffset fields.
* Do not manually add the Authorization header.
* Send the request to get the access token.
* For other APIs, use the access token, X-Auth-Token, in the header.

4. Repeat the steps for [Platform Administration](https://developer.mastercard.com/pclo-presentment/documentation/api-reference/platform-admin/) and [User Account Management](https://developer.mastercard.com/user-account-management-service/documentation/).

### Option 2: Manual configuration {#option-2-manual-configuration}

1. Send a request using any API listed.

## Validate response {#validate-response}

1. Confirm that the request was successful by verifying:

* HTTP 200 response or expected business status
* Response payload from the API
* The plugin applies the Authorization headers
* No scope or permission errors occurred

Tip: The following information explains how the Mastercard Insomnia plugin handles authentication and what a successful API response indicates.   

* The Mastercard Insomnia plugin obtains an OAuth 2.0 access token using client credentials, private key JWT, and DPoP flow.
* The plugin automatically injects Authorization and related headers.
* The API returns a successful response for authorized scope.