FAQs

Visa Developer now uses the Visa Universal Login to provide a unified, secure, and consistent login experience across Visa applications.

A new optional passkey login method appears, offering passwordless, device‑based authentication. Password login remains available.

Yes. Passwords remain available. Passkey is optional.

Passkey allows secure, passwordless sign-in using device-based credentials such as Windows Hello or a FIDO2 security key. New users set it up during signup and existing users are prompted after logging in with email and password. You can learn more on the Visa Developer login screen.

Supported: Windows (via Windows Hello) and Mac (via a FIDO2 security key).
 Not supported: iPhone, iPad, Android devices.

Go to My Account, Security Settings, Create New Passkey and follow the instructions.

Go to My Account, My Security, Manage Passkeys to modify or remove Passkeys.

You can store up to 10 Passkeys. Delete an existing passkey if you reach the limit.

Your account profile remains the same, but you will now see optional fields and security settings that support Passkey authentication. These include expanded contact details (such as phone numbers and work address) and new Passkey management options. These updates do not affect your existing information, and completing the new fields is optional.

If you experience issues, confirm you are using a supported device for passkey authentication, ensure your authentication method (Windows Hello or FIDO2 security key) is functioning correctly, and verify your account information is complete. If issues continue, log in with your password and remove and recreate your passkey from Security settings.

Sign‑in issues may occur if your password is incorrect, your device does not support passkey login, or your authentication settings need resetting. Try signing in with your password or resetting it.

Accounts may become disabled due to inactivity or a security flag. Try resetting your password or signing in again. If the account does not reactivate, contact Visa Developer Support.

A CSR is required to obtain client certificates for APIs using two‑way SSL or message‑level encryption (MLE). Separate CSRs are required for SSL and MLE, and for Certification and Production environments.

Two-Way Secure Sockets Layer (SSL), also known as mutual Transport Layer Security (mTLS), is a mutual authentication process in which the server and client validate each other’s certificates and digital signatures. This ensures each side can trust the connection, prevents spoofed or unauthorized traffic, and adds security.

MLE ensures end‑to‑end encryption of sensitive data such as personally identifiable information (PII), primary account number (PAN), and personal account information (PAI), even across intermediate systems.

You can generate a CSR manually, but Visa Developer also has options to assist you in generating and uploading a CSR. In Sandbox, the CSR can be generated and uploaded automatically for you. In Certification and Production, certificate tools provide the commands needed to create a CSR, but you must generate and upload the CSR yourself. The CSR Wizard generates OpenSSL or Java keytool command lines to help you create a CSR using pre‑populated project information. It is available in your project’s certificate tools.

Check for expiration, incorrect installation, or mismatched environment credentials. Regenerate your CSR and download updated certificates, if needed.

Format errors occur when a certificate is saved in an incorrect file type. Confirm whether your API requires .p12, .pem, or .crt, then convert or regenerate the certificate.

Test your setup by calling a simple endpoint such as Hello World. If it fails, check your headers, certificates, keys, and environment details.

The API may not be enabled in your project. Check your dashboard and request activation if needed. Some APIs require approval.

Verify all required fields, callback URLs, and configuration values. You may need to regenerate credentials after making changes.

Confirm your request parameters match the documentation, your credentials are current, and you are using the correct environment (Sandbox vs Production).