> This page is for version Legacy.
> For other versions, use one of these documentation indexes:
> - 2024-10-01 (default): https://docs.getkard.com/2024-10-01/llms.txt
> - Legacy: https://docs.getkard.com/legacy/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.getkard.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.getkard.com/_mcp/server.

# Authentication

**Kard API**

The Kard API supports authentication via OAuth2.0’s client credentials. Issuer client will be provided **`client_id`** and **`client_secret`** by Kard.

Issuer client sends a **POST** request with the following headers to the **Cognito URL** below to retrieve the **`access_token.` See sample request:**

```bash
curl -X POST https://rewards-api.auth.us-east-1.amazoncognito.com/oauth2/token?grant_type=client_credentials
     -H "Content-Type: application/x-www-form-urlencoded"
     -H "Authorization: {base64 encoded copy of "client_id:client_secret"}"
```

See the [GET a Session Token](https://github.com/kard-financial/kard-postman?tab=readme-ov-file#how-it-works) for more details.

> **Note**
>
> The returned access token must be used in the `Authorization` header as a bearer token
> in subsequent requests.

**Kard’s Earned Rewards Webhook**

For the [earned rewards webhook](/legacy/api/webhooks/payment-notification), Kard will be posting outbound to a URL provided by the issuer client. This webhook is validated via **HMAC signature**.

An issuer client will be provided with a webhook key that is used to generate an HMAC of the webhook body. The HMAC is calculated by Kard and will be sent in the **`notify-signature`** header. Note that header request attributes are processed as **case-insensitive**.

To validate, the issuer client should generate the HMAC with the provided key, body and SHA-256 hashing algorithm and compare against the HMAC provided in the header.

**See the HMAC Signature Verification sub-section under the [Transaction CLO Matching](https://github.com/kard-financial/kard-postman#c-transaction-clo-matching) section for more details on ingesting an earned rewards webhook.**