Authentication

The Antifraude API uses the market-standard OAuth 2.0 protocol to authorize access to its specific resources by environment, Sandbox and Production.

ℹ️
This authentication step is exclusive to Antifraude Apartado. If you use Antifraude integrated with the Gateway de Pagamento or the API E-commerce Cielo, you do not need to follow the authentication step, as authentication is handled by those products' credentials.

How to obtain the access token

During onboarding, you will receive the ClientId and ClientSecret credentials. If you have not received the credential, request it from support.

1. Concatenate the credentials in the format ClientId:ClientSecret;
2. Convert the result to base64, generating a string;

Example:

client_id: braspagtestes

client_secret: 1q2w3e4r5t6y7u8i9o0p0q9w8e7r6t5y4u3i2o1p

String to be Base64-encoded: braspagtestes:1q2w3e4r5t6y7u8i9o0p0q9w8e7r6t5y4u3i2o1p

Result after encoding: YnJhc3BhZ3Rlc3RlczoxcTJ3M2U0cg==

3. Send the base64 string in the Authentication request (POST);
4. The Authentication API will validate the string and return the access_token.

The returned token (access_token) must be used in every request to the Antifraude API as an authorization key. The access_token is valid for 20 minutes and a new one must be generated every time it expires.

See the diagram below for the authentication scheme and how to send the access_token in the fraud analysis request.