# Upgrading from OAuth 1.0a to OAuth 2.0
source: https://developer.mastercard.com/user-account-management-service/documentation/upgrade-to-oauth2/index.md

## Overview {#overview}

This guide walks existing User Account Management Service customers through upgrading their Mastercard Developers project from **OAuth 1.0a** to **OAuth 2.0 + FAPI**. This is the recommended path if you already have a User Account Management Service integration and want to adopt OAuth 2.0 with minimal disruption.
>
> ### You can follow this guide to learn: {#you-can-follow-this-guide-to-learn}
>
> * What changes when you upgrade to OAuth 2.0.
> * How to add Mastercard User Account Management Service to your existing project.
> * How to upgrade your project's authentication model.
> * How to update your application to use OAuth 2.0 tokens.
> * How to request Production Access for the additional API.
Note: **Dual Authentication Support**

User Account Management Service supports **OAuth 1.0a** and **OAuth 2.0** simultaneously. After upgrading, your existing OAuth 1.0a signing key, encryption key, and Client ID will continue to work unchanged. For OAuth 2.0 calls, use your existing Client ID --- you simply won't use the Consumer ID portion of it. You can migrate your application to OAuth 2.0 at your own pace without breaking your existing integration.

## What's Different About OAuth 2.0 {#whats-different-about-oauth-20}

|                          |                   OAuth 1.0a                   |                              OAuth 2.0 + FAPI                              |
|--------------------------|------------------------------------------------|----------------------------------------------------------------------------|
| **Authentication model** | Per-request signing with RSA private key       | Token-based (Client Credentials Grant) with DPoP binding                   |
| **APIs in your project** | User Account Management Service                |                                                                            |
| **Encryption key**       | User Account Management Service encryption key | Same User Account Management Service encryption key --- no change required |
| **Client credentials**   | P12 file + Consumer Key                        | Same P12 file + existing Client ID (Consumer ID portion is not used)       |

## Upgrade Your Project {#upgrade-your-project}

### Step 1 --- Sign in and open your existing project {#step-1--sign-in-and-open-your-existing-project}

1. Navigate to [Mastercard Developers](https://developer.mastercard.com) and sign in.
2. Go to your [My Projects](https://developer.mastercard.com/dashboard) page.
3. Select your existing User Account Management Service project. ![My Projects page showing existing User Account Management Service project](https://static.developer.mastercard.com/content/user-account-management-service/img/upgrade-oauth2-myprojects.png)

### Step 2 --- Upgrade the project to OAuth 2.0 {#step-2--upgrade-the-project-to-oauth-20}

1. From your project page, locate the **Authentication** or **Security** settings.
2. Click **Upgrade to OAuth 2.0** (or the equivalent option shown in your project). ![Upgrade to OAuth 2.0 button on project settings page](https://static.developer.mastercard.com/content/user-account-management-service/img/upgrade-oauth2-bundledapis.png)
3. Review and confirm the upgrade. ![Confirmation screen for the OAuth 2.0 upgrade](https://static.developer.mastercard.com/content/user-account-management-service/img/upgrade-oauth2-confirmupgrade.png)

Note: The project will be configured with **dual authentication** --- both OAuth 1.0a and OAuth 2.0 will be supported simultaneously. Your existing OAuth 1.0a integration will not be affected.

### Step 4 --- Confirm the API and encryption keys {#step-4--confirm-the-api-and-encryption-keys}

After the upgrade, verify the project contains API and encryption keys.

![Project summary showing User Account Management Service API with encryption keys](https://static.developer.mastercard.com/content/user-account-management-service/img/upgrade-oauth2-keys.png)

* **User Account Management** --- present ✓
* **User Account Management Service encryption key** --- present ✓

### Step 5 --- Update your application to use OAuth 2.0 {#step-5--update-your-application-to-use-oauth-20}

Replace OAuth 1.0a request signing with OAuth 2.0 token-based authentication:

* Request an OAuth 2.0 access token using the Client Credentials Grant.
* Include a DPoP proof with each token request and each API call.
* Call User Account Management Service APIs using `Authorization: DPoP <access_token>` and a fresh DPoP proof.
* Continue using the **User Account Management Service encryption key** to encrypt request payloads.

Tip: For a full step-by-step implementation guide, including DPoP proof construction and nonce handling, see the official Mastercard guide: [Using OAuth 2.0 to Access Mastercard APIs](https://developer.mastercard.com/platform/documentation/authentication/using-oauth-2-to-access-mastercard-apis/).

### Step 6 --- Request Production Access for User Account Management Service {#step-6--request-production-access-for-user-account-management-service}

Once you have validated your OAuth 2.0 integration in Sandbox, request Production Access for the User Account Management Service API. This can be done at any time after Step 2.

1. From your project page, go to the **Production** section.
2. Click **Request Production Access** next to **User Account Management** . ![Request Production Access for User Account Management](https://static.developer.mastercard.com/content/user-account-management-service/img/upgrade-oauth2-prodaccess.png)

Note: Typically, it takes 3--5 working days to review and approve a Production access request. You will receive an email from Mastercard Developers at your registered email address with the outcome.