# API Basics
source: https://developer.mastercard.com/small-business-credit-analytics/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses OAuth 1.0a for authenticating your application. You can manage your authentication keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) after you created a project using Small Business Credit Analytics.
Tip: Do you want to learn more about the authentication scheme Mastercard uses? For that, read our [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) guide.

## How to Consume the Small Business Credit Analytics(SBCA) API? {#how-to-consume-the-small-business-credit-analyticssbca-api}

Note: There are multiple ways of integrating with Small Business Credit Analytics:

1. Using a generated API client (recommended)
2. Using a method of your choice

### Generating your own Small Business Credit Analytics API client {#generating-your-own-small-business-credit-analytics-api-client}

Create customizable API clients from the Small Business Credit Analytics API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers the more flexibility and is strongly recommended.

For this, please follow our [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with:

* The following API specification: [swagger.yaml](https://static.developer.mastercard.com/content/small-business-credit-analytics/swagger/swagger.yaml) (35KB)

### Using a method of your choice {#using-a-method-of-your-choice}

Small Business Credit Analytics exposes a REST API: you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client libraries](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#client-libraries) for signing your requests.

For that, please refer to the Small Business Credit Analytics [REST API Reference](https://developer.mastercard.com/small-business-credit-analytics/documentation/api-reference/index.md).

You can also use API development tools like Insomnia or Postman to test the API in Sandbox. Refer to the [Postman Collection](https://developer.mastercard.com/small-business-credit-analytics/documentation/postman-collection/index.md) page to find the tutorial and collection file for Postman or refer to the tutorial for [Insomnia](https://developer.mastercard.com/platform/tutorial/use-insomnia-rest-client-for-mastercard-apis/) to get started with using the SBCA API.

## Environments {#environments}

The table below describes the two different environments that are available.

| **Environment** |                                                                                                                                                                             **Description**                                                                                                                                                                             |
|-----------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox         | Early access environment containing limited-capability mock API's, intended to help assist with the initial integration for new clients. The sandbox returns mock responses for a defined request. The samples can be used as a reference for sending requests and receiving responses. The Sandbox would only validate the length and data type of request parameters. |
| Production      | Full production environment containing the latest production API release. Once all testing has complete and you are ready to go live, you should request access to live production environment.                                                                                                                                                                         |