How to Set Up OAuth 2.0

You enable mutual authentication by obtaining a Certificate Signing Request (CSR) from a supported certificate authority (CA). After obtaining a CSR, you provide your common name details to

Cybersource

. For more information, see Enable Mutual Authentication.

You register your web-application in the

Business Center

and set a scope of permissions and a redirect URL to your web-application. For more information, see Register Your Application.

The merchant accesses your web-application, logs into their account using their credentials, and clicks a button or link to set up their

Cybersource

account.

Your application redirects the merchant to a

Cybersource

-hosted webpage. For more information, see Redirect the Merchant.

The merchant logs in to their

Cybersource

account and approves your request. This authorizes your web-application to perform specific actions on their behalf which are set by the permissions scope that the merchant approved. Notify the merchant that their account must have access to grant OAuth permissions to complete this requirement.

Cybersource

redirects the merchant to your application using the redirect URL you registered. An authentication code is appended to the redirect URL. For more information, see Interpreting the Redirect Response.

Your application exchanges the authorization code with

Cybersource

for these two tokens:

Access token
: A token to authenticate transactions using
Cybersource
. For more information about how to authenticate
Cybersource
transactions using this token, see Submit API Requests Using OAuth.
Refresh token
: A token that you can use to request additional access tokens.