Authentication
1. Generate Service Account
A service account is a special type of non-human client that is granted limited access to your organization's resources.
Permissions to the resources of your organization are controlled by assigning scopes to the service account.
Each CMP Account is uniquely identified by a Tenant ID (also referred to as a Vault ID or Account ID). CMP Accounts are accessed programmatically using Service Account credentials.
You can generate a Service Account in the dashboard or create one using the VGS Command Line Interface (CLI)
Generate a Service Account through UI:
Generate a Service Account through the CMP Dashboard:
Navigate to the Developer Tools section of your CMP Dashboard and select the 'Service accounts' tab
Click the "Create New" button.
Add the following scopes to provide CMP application access to Network Tokens and Account Updater:
cards:write
Required to create a card in VGS and to enroll or unenroll it in the VGS account updater.
cards:read
Required to retrieve card details and account updater information if the card is enrolled.
network-tokens:write
Required to enroll and delete a card in VGS network tokens.
network-tokens:read
Required to retrieve network token information if the card is enrolled.
cards:read-pci
Required to retrieve sensitive card data (PAN and CVC). Applicable to clients that are PCI-compliant.
3ds:write
Required to initiate or manage 3DS device fingerprinting/initialize and authentication.
Note: When CMP accounts are configured, they are configured with an existing account-tenant relationship. This means that service accounts created for a CMP account do not require the extra step to target a specific tenant/vault.
Generate a Service Account through the VGS Vault Dashboard:
Navigate to the Service Accounts section of your Vault Dashboard: Vault > Organization > Service Accounts.
Click on the "Create New" button.
Select your desired Tenant/Vault and add the following scopes to provide CMP application access to Network Tokens and Account Updater:
cards:write
Required to create a card in VGS and to enroll or unenroll it in the VGS account updater.
cards:read
Required to retrieve card details and account updater information if the card is enrolled.
network-tokens:write
Required to enroll and delete a card in VGS network tokens.
network-tokens:read
Required to retrieve network token information if the card is enrolled.
cards:read-pci
Required to retrieve sensitive card data (PAN and CVC). Applicable to clients that are PCI-compliant.
3ds:write
Required to initiate or manage 3DS device fingerprinting/initialize and authentication.
Generate a Service Account through CLI:
Execute the sample code below, which will create credentials.yaml file:
2. Generate Access Token
To authenticate with the CMP APIs, you should use the CLIENT_ID and CLIENT_SECRET generated in the previous step to create an access_token.
The generated token can now be used with the CMP APIs. Please note that this access_token is valid only for 20 minutes. After expiry, you can generate a new access token using the same process. refresh_token should not be used. Pass the created access_token as an Authorization: Bearer ${VGS_ACCESS_TOKEN} header in each API call.
3. Generate Access Credentials
To create access credentials, go to the Vault Dashboard > Vault > Vault Settings > Access Credentials and press the "Generate Credentials" button. When Access Credentials are generated, you will be prompted to download them.
If you lose these credentials, you can generate a new pair following the same process.
Last updated