# API Basics
source: https://developer.mastercard.com/small-business-credit-analytics/documentation/api-basics/index.md

## API Security {#api-security}

### Client Authentication {#client-authentication}

Mastercard uses OAuth 1.0a for authenticating your application. You can manage your authentication keys from your [Developer Dashboard](https://developer.mastercard.com/dashboard) after you created a project using Small Business Credit Analytics.
Tip: Do you want to learn more about the authentication scheme Mastercard uses? For that, read our [Using OAuth 1.0a to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/) guide.

## How to Consume the Small Business Credit Analytics(SBCA) API? {#how-to-consume-the-small-business-credit-analyticssbca-api}

Note: There are multiple ways of integrating with Small Business Credit Analytics:

1. Using a generated API client (recommended)
2. Using a method of your choice

### Generating your own Small Business Credit Analytics API client {#generating-your-own-small-business-credit-analytics-api-client}

Create customizable API clients from the Small Business Credit Analytics API specification and let Mastercard open-source client libraries handle the authentication for you. This approach offers the more flexibility and is strongly recommended.

For this, please follow our [Generating and Configuring a Mastercard API Client](https://developer.mastercard.com/platform/documentation/security-and-authentication/generating-and-configuring-a-mastercard-api-client/) tutorial with:

* The following API specification: [swagger.yaml](https://static.developer.mastercard.com/content/small-business-credit-analytics/swagger/swagger.yaml) (35KB)

### Using a method of your choice {#using-a-method-of-your-choice}

Small Business Credit Analytics exposes a REST API: you are free to use the REST/HTTP client of your choice and can still leverage the Mastercard open-source [client libraries](https://developer.mastercard.com/platform/documentation/security-and-authentication/using-oauth-1a-to-access-mastercard-apis/#client-libraries) for signing your requests.

For that, please refer to the Small Business Credit Analytics [REST API Reference](https://developer.mastercard.com/small-business-credit-analytics/documentation/api-reference/index.md).

You can also use API development tools like Insomnia or Postman to test the API in Sandbox. Refer to the [Postman Collection](https://developer.mastercard.com/small-business-credit-analytics/documentation/postman-collection/index.md) page to find the tutorial and collection file for Postman or refer to the tutorial for [Insomnia](https://developer.mastercard.com/platform/tutorial/use-insomnia-rest-client-for-mastercard-apis/) to get started with using the SBCA API.

## Environments {#environments}

The table below describes the two different environments that are available.

| **Environment** |                                  **Base URL**                                  |                                                                                                                                                                             **Description**                                                                                                                                                                             |
|-----------------|--------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Sandbox         | `https://sandbox.api.mastercard.com/small-business/credit-analytics/locations` | Early access environment containing limited-capability mock API's, intended to help assist with the initial integration for new clients. The sandbox returns mock responses for a defined request. The samples can be used as a reference for sending requests and receiving responses. The Sandbox would only validate the length and data type of request parameters. |
| Production      | `https://api.mastercard.com/small-business/credit-analytics/locations`         | Full production environment containing the latest production API release. Once all testing has complete and you are ready to go live, you should request access to live production environment.                                                                                                                                                                         |

Note: OAuth 1.0a authentication and JWE payload encryption work the same way in Sandbox and Production. The main changes are the Production key set, the Production approval state, and the Production base URL.