# Authentication

Insights API v1 supports Basic Authentication and Bearer HMAC Authentication.
Use the method provisioned for your integration.

## Basic Authentication

Send these headers:

| Header | Value |
| --- | --- |
| `Authorization` | `Basic <Base64(username:password)>` |
| `Merchant-Key` | Merchant key provided by Privy |
| `Content-Type` | `application/json` |

```http
Authorization: Basic <credentials>
Merchant-Key: <merchant-key>
Content-Type: application/json
```

## Bearer HMAC Authentication

Send these headers:

| Header | Value |
| --- | --- |
| `Authorization` | `Bearer <access-token>` |
| `Content-Type` | `application/json` |
| `Timestamp` | Request timestamp used to generate the signature |
| `Signature` | Base64-encoded client ID and HMAC signature |

Build the signature as follows:

1. Remove spaces, line breaks, and backslashes from the JSON request body.
2. Calculate the MD5 digest of the resulting body and encode the digest as Base64.
3. Join `Timestamp`, client ID, HTTP method, and the Base64 MD5 value with colons:
   `timestamp:client_id:POST:body_md5_base64`.
4. Calculate HMAC-SHA256 using the client secret, then encode the result as Base64.
5. Build `#client_id:#hmac_base64` and Base64-encode that complete value for the
   `Signature` header.

```http
Authorization: Bearer <access-token>
Content-Type: application/json
Timestamp: <timestamp>
Signature: <base64-encoded-signature-envelope>
```

Keep all credentials and signing secrets on your server. Never expose them in
browser or mobile application code.