Authentication Methods

3 min

\\ topic type constraint purpose explain authentication methods used for accertify apis audience api integrators and client developers applies to accertify apis that require authenticated http requests does not apply to internal batch processing or non‑request‑based integrations all api requests must be authenticated using one of the supported authentication methods authentication establishes the identity of the client and ensures that requests are processed under the correct integration context authentication requirements apply uniformly across industries, endpoints, and fraud‑related lifecycle contexts supported authentication methods apis support the following authentication methods basic authentication oauth 2 0 client credentials clients must use one of these methods consistently per integration, as configured during onboarding authentication methods affect how a request is authorized but do not change how transactions are evaluated, scored, or processed basic authentication basic authentication uses credentials issued by and is typically implemented during initial integrations when using basic authentication credentials are provided with each request credentials are transmitted in the http authorization header credentials are tied to the integration configuration provided during onboarding requests must continue to comply with all field validation, hashing, and data integrity requirements \ example \ authorization basic \<base64(username\ password)> accertify provides the credentials required for basic authentication during implementation oauth 2 0 (client credentials) oauth 2 0 using the client credentials grant is supported as an alternative authentication method this authentication method uses short lived access tokens rather than sending static credentials with every api request oauth setup must be coordinated during onboarding contact accertify support or your implementation team if oauth authentication is required oauth token endpoint oauth access tokens are requested from the following endpoint https //api accertify net/api/oauthv1/token https //api accertify net/api/oauthv1/token oauth authentication flow oauth authentication follows this process request an access token from the configured oauth token service receive an access token include the access token in the authorization header of api requests obtain a new token when the existing token expires \ example \ authorization bearer \<access token> requesting an access token oauth access tokens are obtained using the oauth 2 0 client credentials grant type method 1 client credentials in the request body request body \ example \ grant type=client credentials client id=\<client id> client secret=\<client secret> scope=\<rtd> where grant type must be client credentials scope is the scope assigned to the integration client id is the api user name provided by accertify client secret is the api secret provided by accertify method 2 basic authentication header credentials may also be supplied in the authorization header \ example \ header authorization basic \<base64(client id\ client secret)> request body grant type=client credentials scope=\<scope> using the access token after obtaining an access token, include it in the authorization header for api requests authorization bearer \<access token> all subsequent api calls use the bearer token until the token expires or is replaced when oauth 2 0 is commonly used oauth 2 0 is commonly selected when centralized credential management is required short lived tokens are preferred over static credentials organizational security standards require token based authentication enterprise integration standards require oauth based authentication integration configuration authentication credentials, client identifiers, secrets, tokens, importer identifiers, and related configuration details are issued during onboarding implementation details may vary by environment and integration type always use the authentication credentials and endpoints provided for your specific implementation