Authentication methods
Discover Visa Developer API authentication methods—Two-Way SSL and X-Pay Token—and learn which to choose for your integration.
Overview
Visa Developer APIs require secure authentication to protect data and verify trusted integrations. Visa Developer supports a few authentication method options so you can choose the one that works best for your integration.
This guide helps you:
- Discover the authentication methods supported by Visa Developer APIs
- Choose the right authentication for your integration
- Take next steps to configure authentication in your project
Two-Way SSL
Two‑Way Secure Sockets Layer (SSL), also called mutual Transport Layer Security (mTLS), is a certificate‑based mutual authentication between your application and Visa Developer. It provides strong mutual authentication and full client–server verification.
How Two-Way SSL works
Two‑Way SSL establishes a mutually authenticated connection between your system and Visa Developer before any API data is exchanged.
During the connection:
- Your system initiates an HTTPS connection to Visa Developer.
- Visa Developer presents its server certificate.
- Your system validates the Visa Developer certificate against trusted Certificate Authorities (CAs).
- Visa Developer requests your system to send the client certificate.
- Your system presents the client certificate issued for your project.
- Visa Developer validates your certificate to confirms possession of the matching private key.
- A mutually authenticated TLS session is established.
After this TLS handshake completes successfully, requests or callbacks can proceed.
Review requirements and learn how to configure Two-Way SSL for your project.
X-Pay Token
X‑Pay Token is an authentication method between your application and Visa Developer that uses an API key and shared secret. It requires decrypting the shared secret using a public–private key pair, then using the decrypted value to authenticate each API request.
How X-Pay Token works
X‑Pay Token operates at the request level to ensure message integrity and client authenticity for every API call.
During an API request:
- The request includes an API key as a query parameter and an X‑Pay Token header.
- The X‑Pay‑Token is derived from specific request elements, including a timestamp, resource path, query parameters, and request body.
- Visa independently reconstructs the request data.
- Visa validates the token using the shared secret associated with the X-Pay Token.
Visa processes an API request after the X‑Pay Token is successfully validated against the correct environment, request data, and timestamp.
Review requirements and learn how to use X-Pay Token with your project.
Choosing the right authentication method
Visa Developer APIs may support one or more authentication methods. The method you choose affects how credentials are generated and used across your integration lifecycle.
Consider the following when selecting an authentication method.
Infrastructure fit
All supported methods provide secure request authentication when implemented correctly. Differences lie in how credentials are issued.
Security model
Choose the level of security appropriate for your use case. Both methods securely verify trusted integrations. Two‑Way SSL establishes mutual trust between systems at the transport layer, while X‑Pay Token validates each API request using cryptographic verification of request data.
Operational considerations
Each method has different requirements for credential generation and expiration across Sandbox, Certification, and Production environments.
Review the setup steps for each method before choosing the option that best fits your integration.
Authentication across the integration lifecycle
Authentication decisions affect your integration across its lifecycle—not just when you make your first API call.
- Planning: Select an authentication method that aligns with your architecture and credential management practices.
- Environment setup: Configure and use the required credentials for each environment (Sandbox, Certification, Production) to authenticate API requests.
- Going live: Ensure credentials are valid, properly installed, and ready for Production traffic.
- Ongoing operation: Continue using your authentication credentials when making API calls and when managing credential rotation and expiration over time.