# Upgrading from OAuth 1.0a to OAuth 2.0
source: https://developer.mastercard.com/transactions-service/documentation/upgrade-to-oauth2/index.md

## Overview {#overview}

This guide walks existing Transactions Service customers through upgrading their Mastercard Developers project from **OAuth 1.0a** to **OAuth 2.0 + FAPI**. This is the recommended path if you already have a Transactions Service integration and want to adopt OAuth 2.0 with minimal disruption.
>
> ### You can follow this guide to learn: {#you-can-follow-this-guide-to-learn}
>
> * What changes when you upgrade to OAuth 2.0.
> * How to add Transactions Service to your existing project.
> * How to upgrade your project's authentication model.
> * How to update your application to use OAuth 2.0 tokens.
> * How to request Production Access for the additional API.
Note: **Dual Authentication Support**

Transactions Service supports **OAuth 1.0a** and **OAuth 2.0** simultaneously. After upgrading, your existing OAuth 1.0a signing key, and Client ID will continue to work unchanged. For OAuth 2.0 calls, use your existing Client ID --- you simply won't use the Consumer ID portion of it. You can migrate your application to OAuth 2.0 at your own pace without breaking your existing integration.

## What's Different About OAuth 2.0 {#whats-different-about-oauth-20}

|                          |                OAuth 1.0a                |                           OAuth 2.0 + FAPI                           |
|--------------------------|------------------------------------------|----------------------------------------------------------------------|
| **Authentication model** | Per-request signing with RSA private key | Token-based (Client Credentials Grant) with DPoP binding             |
| **APIs in your project** | Transactions Service                     |                                                                      |
| **Client credentials**   | P12 file + Consumer Key                  | Same P12 file + existing Client ID (Consumer ID portion is not used) |

## Upgrade Your Project {#upgrade-your-project}

### Step 1 --- Sign in and open your existing project {#step-1--sign-in-and-open-your-existing-project}

1. Navigate to [Mastercard Developers](https://developer.mastercard.com) and sign in.
2. Go to your [My Projects](https://developer.mastercard.com/dashboard) page.
3. Select your existing Transactions Service project. ![My Projects page showing existing Transactions Service project](https://static.developer.mastercard.com/content/transactions-service/img/upgrade-oauth2-myprojects.png)

### Step 2 --- Upgrade the project to OAuth 2.0 {#step-2--upgrade-the-project-to-oauth-20}

1. From your project page, locate the **Authentication** or **Security** settings.
2. Click **Upgrade to OAuth 2.0** (or the equivalent option shown in your project). ![Upgrade to OAuth 2.0 button on project settings page](https://static.developer.mastercard.com/content/transactions-service/img/upgrade-oauth2-bundledapis.png)
3. Review and confirm the upgrade. ![Confirmation screen for the OAuth 2.0 upgrade](https://static.developer.mastercard.com/content/transactions-service/img/upgrade-oauth2-confirmupgrade.png)

Note: The project will be configured with **dual authentication** --- both OAuth 1.0a and OAuth 2.0 will be supported simultaneously. Your existing OAuth 1.0a integration will not be affected.

### Step 4 --- Confirm the API key {#step-4--confirm-the-api-key}

After the upgrade, verify the project contains the API key.

![Project summary showing Transactions Service API key](https://static.developer.mastercard.com/content/transactions-service/img/upgrade-oauth2-keys.png)

* **Transactions Service** --- present ✓

### Step 5 --- Update your application to use OAuth 2.0 {#step-5--update-your-application-to-use-oauth-20}

Replace OAuth 1.0a request signing with OAuth 2.0 token-based authentication:

* Request an OAuth 2.0 access token using the Client Credentials Grant.
* Include a DPoP proof with each token request and each API call.
* Call Transactions Service APIs using `Authorization: DPoP <access_token>` and a fresh DPoP proof.

Tip: For a full implementation walkthrough including DPoP proof construction and nonce handling, see the official Mastercard guide: [Using OAuth 2.0 to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-2-to-access-mastercard-apis/).

### Step 6 --- Request Production Access for Transactions Service {#step-6--request-production-access-for-transactions-service}

Once you have validated your OAuth 2.0 integration in Sandbox, request Production Access for the Transactions Service API. This can be done at any time after Step 2.

1. From your project page, go to the **Production** section.
2. Click **Request Production Access** next to **Transactions Service** . ![Request Production Access for Transactions Service](https://static.developer.mastercard.com/content/transactions-service/img/upgrade-oauth2-prodaccess.png)

Note: Typically, it takes 3--5 working days to review and approve a Production access request. You will receive an email from Mastercard Developers at your registered email address with the outcome.