Only some APIs support mutual authentication. For the full list, see Supported APIs<\/a>.<\/li><\/ul><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nHow it works<\/h2>\n
To set up mutual authentication:<\/p>\n
\n- You create a private key and a certificate signing request.<\/li>\n
- You send the certificate signing request to Adyen.<\/li>\n
- Adyen signs the request and returns your client certificate and certificate chain.<\/li>\n
- You link the subject DN of the certificate to an API credential.<\/li>\n
- You send API requests to a mutual authentication endpoint<\/a> with your certificate.<\/li>\n<\/ol>\n
Adyen accepts the request when the subject DN of the certificate matches the subject DN stored for the API credential.<\/p>\n
Generate a client certificate<\/h2>\n
To generate a client certificate:<\/p>\n
\n- \n
Create a private key and a certificate signing request:<\/p>\n
openssl req -new \\\n -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 \\\n -keyout client.key \\\n -out client.csr \\\n -subj \"\/CN=adyen-mtls-client\"<\/code><\/pre>\nOpenSSL prompts for a passphrase and encrypts client.key<\/code> with it. Keep both the passphrase and client.key<\/code> secret. You cannot get client.key<\/code> from Adyen if you lose it.<\/p>\nAdyen does not use the subject in your certificate signing request. Adyen builds the subjectDN<\/code> of the signed certificate from the company account in the request path and the apiCredential<\/code> in the request body, in the format:<\/p>\nUID={apiCredential}-Company.{companyId},CN={apiCredential}-Company.{companyId},O=Company.{companyId}<\/code><\/pre>\nUse any subject in the -subj<\/code> value.<\/p>\n<\/li>\n- \n
Convert the certificate signing request to a Base64-encoded DER string:<\/p>\n
openssl req -in client.csr -outform DER | openssl base64 -A<\/code><\/pre>\n<\/li>\n- \n
Make a POST \/companies\/{companyId}\/clientCertificates<\/code> request. In the request, include:<\/p>\n\n\n\n| Parameter<\/th>\n | Description<\/th>\n<\/tr>\n<\/thead>\n |
\n\napiCredential<\/code><\/td>\nThe API credential that you want to use the certificate with, in the format: ws_*@Company.*<\/code>. The credential must belong to the company account in the request path. If you send a merchant-level credential, or a credential from another company account, you get a 403 error.<\/td>\n<\/tr>\n\ncertificateSigningRequest<\/code><\/td>\nThe certificate signing request from the previous step, as a Base64-encoded DER string.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\ncurl https:\/\/management-live.adyen.com\/v3\/companies\/YOUR_COMPANY_ACCOUNT\/clientCertificates \\\n-X POST \\\n-H 'x-API-key: ADYEN_API_KEY' \\\n-H 'content-type: application\/json' \\\n-d '{\n \"apiCredential\": \"ws_123456@Company.YourCompanyAccount\",\n \"certificateSigningRequest\": \"YOUR_BASE64_ENCODED_CSR\"\n}'<\/code><\/pre>\n
| | | |