# Authentication

ID Card Forgery v1 supports Basic Authentication and Bearer HMAC
Authentication.

## Basic Authentication

Send the merchant username and password through the HTTP `Authorization`
header using the Basic scheme, and send the provisioned merchant key in the
`Merchant-Key` header.

```http
Authorization: Basic <base64-encoded-credentials>
Merchant-Key: <merchant-key>
Content-Type: application/json
```

## Bearer HMAC Authentication

Send the provisioned Bearer token in `Authorization` and include `Timestamp`
and `Signature`. The signature is the Base64 representation of
`#client_id:#hmac_base64`; calculate the HMAC-SHA256 input from
`timestamp:client_id:POST:body_md5_base64`.

```http
Authorization: Bearer <access-token>
Timestamp: <unix-timestamp>
Signature: <base64-signature>
Content-Type: application/json
```

Keep credentials, merchant keys, tokens, and signing secrets in a secure
server-side secret store. Do not expose them in browser or mobile application
code.