On This Page

Introduction to OAuth 2.0 Integration

OAuth 2.0 is an industry-standard authorization protocol that enables your client to securely delegate limited access to other clients without exposing sensitive credentials. Instead of you having to share passwords or API keys, OAuth 2.0 enables secure token-based authentication between clients for better security and control over data access. This guide explains the different OAuth 2.0 integration methods available through Cybersource and how to integrate to the best method for your organization. For the purposes of this guide, a client
can be an application, platform, system, or AI agent, depending on your organization.

Benefits of OAuth 2.0

OAuth 2.0 replaces direct credential sharing with a secure-token method, which provides these benefits:

Enables delegated access for merchants authorizing partner access.

Supports system-to-system integrations without user interaction.

Enables controlled access using scopes and tokens.

Users can revoke access at any time.

Participants

OAuth 2.0 involves these participants working together to grant client access securely:

Merchant:
the resource owner who owns the protected resource and can grant your client access to it.

Cybersource OAuth API:
The authorization server that authenticates the resource owner and issues access tokens after a successful authorization.

Cybersource APIs:
the resource server that hosts the protected resource that you want to access, such as the payments API.

Client or Portfolio:
The technology partner solution or acquirer platform that requests access to the protected resource on behalf of the resource owner.

Prerequisites

You must create a Cybersource Business Center account to complete the set up tasks described in this guide. The type of account you create is dependent on your organization type:

Create a Test Account: Acquirer Partners:
To sign up for an account as an acquirer partner who manages a portfolio of merchants, see the Become a partner sign up page on the Cybersource developer center.
Merchants:
To sign up for a sandbox test account, see the Sandbox account sign up page on the Cybersource developer center.
Technology Partners:
To sign up for an account as a technology partner who develops applications for merchants, see the Become a partner sign up page on the Cybersource developer center.
Set Up REST: Your system must also be REST-compliant in order for you to send API requests on-behalf-of merchants and other users. Cybersource uses the REST API to securely communicate with your system. For more information about how to set up your system to use REST, see the Getting Started with REST Developer Guide.