Log in to the
Business Center
:
Test:
https://businesscentertest.cybersource.com
Production:
https://businesscenter.cybersource.com
On the left navigation panel, choose
Account Management > OAuth Application Management
.
Click
Add Application
.
The Add Application page appears.
In the Authentication Type drop-down menu, choose one of these authentication types:
ADDITIONAL INFORMATION
OAuth 2.0 (API Access):
Use for API authorization access to
Cybersource
APIs.
OpenID Connect (User Sign-In):
Used for user authentication and identity, which includes ID token support.
In the Application Type drop-down menu, choose one of these application types:
ADDITIONAL INFORMATION
Web Application:
Sever-side applications capable of securely storing credentials.
Mobile Application (for OpenID Connect only):
Public client application, such as mobile or native apps.
Server Integration (for OAuth 2.0 Connect only):
Machine-to-machine (M2M) communication without user consent, such as remote MCP or AI agents.
In the Application information section, enter this information:
Application name:
The name of the application that you are registering.
Application description:
A brief description of the application.
In the OAuth configuration section, enter the URL to which the user is redirected after granting permissions with auth_code.
Click
Next
when done.
The Product Configuration page appears.
Configure your API permissions by choosing which
scopes
your application can access.
Scopes determine which
Cybersource
APIs your application can use. Only choose the minimum necessary scopes needed for your organization in order to avoid unnecessary access. This is also known as following the principle of least privilege (PoLP).
Click
Save
when done.
Your
client ID
and
client secret
are generated. These credentials are required for OAuth authentication.
IMPORTANT
Securely store these credentials in your system. The client secret displays once and will not be viewable again. If you forget it or it is compromised, you can regenerate a new one any time.
Click
Done
to return to the Authorized Applications page.

AFTER COMPLETING THE TASK

Log in to the
Business Center
:
Test:
https://businesscentertest.cybersource.com
Production:
https://businesscenter.cybersource.com
On the left navigation panel, choose
Partner Management > Manage Solutions
.
ADDITIONAL INFORMATION
The Manage Solutions page appears.
Click
Add Solution
.
Follow the guided process to enter the required information for onboarding your solution.
IMPORTANT
Define the
Cybersource
products that are part of your integration during solution onboarding. You can find the products and services available for integration on the Developer Center API Reference. The solution onboarding flow presents the product scopes that align with the available products and services.

AFTER COMPLETING THE TASK

Log in to the
Business Center
:
Test:
https://businesscentertest.cybersource.com
Production:
https://businesscenter.cybersource.com
On the left navigation panel, choose
Account Management > Authorized Applications
.
The OAuth Applications page appears.
Click
Revoke
next to the corresponding OAuth application that you no longer want processing API requests on your behalf.

Set the host domain for the redirect URL:

Production:
https://businesscenter.cybersource.com
/ebc2/
Test:
https://businesscentertest.cybersource.com
/ebc2/

Append the host domain with a question mark (

?

) to designate the start of the query-string.

Include these query-parameters with an ampersand (

&

) after each consecutive parameter. Set the required parameters in the order that they are listed.

Required Request Parameters

Request Parameter	Description
response_type	Set to code .
client_id	The client identifier issued by Cybersource when you registered your application. Example: client_id=abc123xyz
redirect_uri	The URI to which the merchant is redirected to after granting your application authorization in the Business Center . Example: redirect_uri=https://app.example.com/callback
state	A value your application generates that is used as CSRF protection. The generated value must be unique and cryptographically random. After the merchant grants your application authorization, Cybersource redirects the merchant to your application and appends this value to the redirect URL. Example: state=af0ifjsldkj
code_challenge	The PKCE code challenge is a SHA-256 hash of the code verifier, encoded using Base64URL. For more information about generating a code verifier and its code challenge value, see the Generating a Code Verifier and Code Challenge section below.
code_challenge_method	Set to S256 .

IMPORTANT

The recommended fields add additional security when obtaining permissions from the merchant.

Example: Readable Redirect URL

This example is formatted in a readable structure and is not intended to be used.

https://businesscenter.cybersource.com/ebc2/oauth2/authorize?
response_type=code&
client_id={yourClientId}&
code_challenge={codeChallenge}&
code_challenge_method=S256&
redirect_uri={yourCallbackUrl}&
state={state}

Example: Encoded URL for Implementation

This example is formatted correctly for implementation.

https://businesscenter.cybersource.com/ebc2/oauth2/authorize?response_type=code&client_id={yourClientId}&code_challenge={codeChallenge}&code_challenge_method=S256&redirect_uri={yourCallbackUrl}&state={state}

Set your application to use your constructed URL to redirect merchants who want to grant permissions.

Cybersource

redirects the merchant back to your application after the merchant completes granting permissions. The URL used to redirect the merchant to your application is the URL you submitted during registration. It includes these response parameters appended to it:

your_registered_redirect_URL?code={authorization_code}&state={state}

Response Parameters

Response Parameter	Description
code	The authorization code that is used to request access and refresh tokens. It expires ten minutes after being issued. If the code expires, you must request merchant authorization again.
state	The CSRF protection value that you sent in the state parameter. If this value does not match the value you sent, reject the request.

AFTER COMPLETING THE TASK

To create a code verifier, run one of these code snippets in a terminal:
Java Example
import java.security.SecureRandom;
import java.util.Base64;

SecureRandom sr = new SecureRandom();
byte[] code = new byte[32];
sr.nextBytes(code);

String codeVerifier = Base64.getUrlEncoder()
    .withoutPadding()
    .encodeToString(code);

// Use codeVerifier as the code verifier parameter value.
JavaScript Example
// Dependency: Node.js crypto module

const crypto = require('crypto');

function base64URLEncode(buffer) {
    return buffer.toString('base64')
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=/g, '');
}

const code_verifier = base64URLEncode(crypto.randomBytes(32));

// Use code_verifier as the code verifier parameter value.
Run one of these code snippets and include the code verifier value that you generated in the previous step:
Java Example
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

SecureRandom sr = new SecureRandom();
byte[] code = new byte[32];
sr.nextBytes(code);

String codeVerifier = Base64.getUrlEncoder()
    .withoutPadding()
    .encodeToString(code);

byte[] bytes = codeVerifier.getBytes(StandardCharsets.US_ASCII);
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(bytes);

String codeChallenge = Base64.getUrlEncoder()
    .withoutPadding()
    .encodeToString(digest);

// Use codeChallenge as the code challenge parameter value.
// Use "S256" as the code challenge method parameter value.
JavaScript Example
const crypto = require('crypto');

function base64URLEncode(buffer) {
    return buffer.toString('base64')
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=/g, '');
}

function sha256(buffer) {
    return crypto.createHash('sha256').update(buffer).digest();
}

const code_verifier = base64URLEncode(crypto.randomBytes(32));
const code_challenge = base64URLEncode(sha256(code_verifier));
Set the
code_challenge
parameter to the generated code challenge value.
Store the original code verifier value temporarily. You must send the same code verifier in your access token request.
IMPORTANT
Do not regenerate the code verifier before the token request.

Set the host domain to this endpoint:

Production:
POST
https://api.cybersource.com
/ebc2/oauth2/authorize
Test:
POST
https://apitest.cybersource.com
/ebc2/oauth2/authorize

Append the endpoint with a question mark (

?

) to designate the start of the query-string.

Include these query-parameters with an ampersand (

&

) after each consecutive parameter. Set the required parameters in the order that they are listed.

Required Query Parameters

Parameter	Description
grant_type	Set to authorization_code .
code	The authorization code received from the authorization response. For more information about how to obtain an authorization code, see Obtain Merchant Authorization.
redirect_uri	The redirect URI that is registered to the OAuth application.
client_id	The client ID that is issued during OAuth registration for your application.
client_secret	The client secret that is issued during OAuth registration for your application.
code_verifier	The code verifier that was created during the authorization request. It is a PKCE verifier. For more information about how to create a code verifier, see the Generate a Code Verifier section in Obtain Merchant Authorization.

Send the API request using your constructed endpoint with an empty message body.

Example: Readable Request Example for an Access Token

This example is formatted in a readable structure and is not intended to be used.

https://api.cybersource.com/oauth2/v4/token?
grant_type=authorization_code
&code={authorization_code}
&redirect_uri={redirect_uri}
&client_id={client_id}
&client_secret={client_secret}

Example: Encoded Request Example for Access Token

This example is formatted correctly for implementation.

https://api.cybersource.com/oauth2/v4/token?grant_type=authorization_code&code={authorization_code}&redirect_uri={redirect_uri}&client_id={client_id}&client_secret={client_secret}

Example: Request Body

{}

Cybersource

responds with an access token in the

access_token

field and a refresh token in the

refresh_token

field:

Response Example

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6Ikp...",
  "token_type": "bearer",
  "refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "expires_in": 900,
  "refresh_token_expires_in": 2592000,
  "client_status": "active"
}

Response Fields

Response Field	Description
access_token	The access token used to authenticate API requests. Include this token in the Authorization request header as a bearer token.
client_status	The status of the client, such as active .
expires_in	The amount of time, in seconds from token creation, that the access token is valid.
refresh_token_expires_in	The amount of time, in seconds from token creation, that the refresh token is valid.
refresh_token	The refresh token used to maintain access after the initial access token expires.
token_type	The type of token that is issued.

AFTER COMPLETING THE TASK

Create a JWT header using these header fields:

JWT Header Fields

Header Field	Description
alg	The asymmetric algorithm you use to sign the token header. These algorithms are supported: RS256 (default) RS384 RS512 PS256 PS384 PS512
kid	The key ID you use to digitally sign the JWT. It must be registered with the authorizing server. It is the key ID from your P12 certificate.
typ	The token type. Set to JWT .

{
  "alg": "RS256",
  "kid": "your_p12_key_id",
  "typ": "JWT"
}

Construct the JWT payload as a JSON object that contains these required body claims:

JWT Body Claim Fields

Body Claim Field	Description
aud	Set to the Cybersource token endpoint. This is the audience of the JWT.
exp	The expiration time, in Unix epoch seconds. Keep the amount of time the token is valid short.
iat	The time at which the token is issued in Unix epoch seconds.
iss	The issuer of the JWT. Set to one of these possible values: For embedded components, set to the partner organization ID. For remote MCP direct access, set to the merchant ID.
jti	A unique JWT identifier, such as a UUID. This value must be unique for each request to help prevent replay attacks.
scope	The scopes requested by your application. Set to one of these possible values: For embedded components, set to boarding . For remote MCP direct access, set to transaction_search user_management .
sub	Subject of the JWT. Set to your application's client ID, which is the client_id value.
v-c-merchant-id	The organization or merchant that the access token is created for. Set to one of these possible values: For embedded components, set to the portfolio organization ID or merchant ID. For remote MCP direct access, set to the merchant ID.
v-c-response-mle-kid	The key identifier for message-level encryption (MLE) of the response.

{
   "iss": "partner_org_id",
   "sub": "client_id",
   "aud": "https://api.cybersource.com/oauth2/v4/token",
   "jti": "f3d0a7c2-5e8b-4c9a-b1d3-e4f5a6b7c8d9",
   "exp": 1699565100,
   "iat": 1699564800,
   "v-c-merchant-id": "Portfolio Org ID or Merchant ID",
   "scope": "boarding",
   "v-c-response-mle-kid": "50622d914e4bc08352af3d50bce77120"
}

Encode the JWT header and payload using Base64URL.

{base64url_encoded_header}

{base64url_encoded_payload}

Create the signing input by combining the encoded header and encoded payload.

{base64url_encoded_header}.{base64url_encoded_payload}

Sign the JWT with the private key from your P12 certificate. Use the P12 certificate that is registered to your OAuth application, platform, or system.

This is a conceptual example for how to obtain the encoded signature using Base64URL:

sign("{base64url_header}.{base64url_payload}", private_key) = {base64url_encoded_signature}

Combine the encoded header, payload, and signature with the period character (

.

) separating each variable. This creates the signed client assertion JWT.

{base64url__encoded_header}.{base64url_encoded_payload}.{base64url_encoded_signature}

This is a shortened example of what your signed client assertion JWT could look like:

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJtZXJjaGFudF9pZCIsInN1YiI6ImNsaWVudF9pZCJ9.XYabc123...

Set the

client_assertion

request parameter in the access token request to the JWT string value.

client_assertion={signed_jwt}

This is an example of the client assertion in a complete access token request:

POST https://api.cybersource.com/oauth2/v4/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
&
client_assertion={signed_jwt}

Log in to the
Business Center
:
Test:
https://businesscentertest.cybersource.com
Production:
https://businesscenter.cybersource.com
Click
Account Management
in the left-navigation menu and choose
Authorized Applications
. The OAuth Authorized Applications page appears.
Click
Add Application
. You must use an administrator account to add or change an application.
Enter this information:
Name of the application that you are registering.
Description of the application.
URL to redirect the merchant to your system after they grant permissions. For more information about the redirect, see Redirecting the Merchant to
Cybersource
.
Choose permissions for individual APIs or for all listed APIs.
Click
Save
.
Your application is registered, and your application’s client ID and client secret are shown. You will need them in order to redirect the merchant. Treat the client ID and client secret as confidential information and store them securely. You can regenerate your client secret if you misplace it or if its security is compromised.
Click
Done
to return to the previous page.