On This Page

Create a Shared Secret Key for HTTP Signature Authentication

HTTP Signature authentication is provided by a Base-64 encoded transaction key, represented in a string format.

Before you can send requests for CyberSource REST API services that are authenticated using HTTP Signature, you must create a shared secret key for your CyberSource merchant account in the Business Center.

IMPORTANT

You must use separate keys for the test and production environments.

The shared secret key created in the Business Center is viable for 3 years.

To create a shared secret key:

In the left navigation panel, choose Key Management
.

Expand the Transaction Processing
menu.

From the drop-down menu, choose API Keys
.

Click GENERATE KEY
.

Choose API Cert / Secret
, then click NEXT STEP
.

Choose Shared Secret
, then click SUBMIT
.

To download the shared secret key to a .txt
file, click DOWNLOAD KEY
.

IMPORTANT

Make note of the public key (key) that is generated. This value is required in the header of each REST API call.

If you need another key, click CREATE ANOTHER KEY
.

To see the newly generated key at the bottom of the Key list, click KEY MANAGEMENT
.

The CyberSource SDK requires the key and the shared secret key to use the HTTP signature as an authentication mechanism.

Deactivating Shared Secret Keys

When you deactivate a key it is immediately removed from active status.

To deactivate a shared secret key:

In the left navigation panel, choose Key Management
.

Expand the Transaction Processing menu.

From the drop-down menu, choose API Keys
.

Select the key and click the X
icon to deactivate the key.