# Authentication

Phone Income Score v1 supports either Basic Authentication or Bearer HMAC Authentication.

## Basic Authentication

Send the provisioned merchant username and password in the HTTP `Authorization` header and include the provisioned `Merchant-Key` header.

## Bearer HMAC Authentication

Send the provisioned Bearer token in `Authorization` and include `Timestamp` and `Signature`. The signature is the Base64 representation of `#client_id:#hmac_base64`; calculate the HMAC-SHA256 input from `timestamp:client_id:POST:body_md5_base64`.

Never expose credentials or signing secrets in client-side applications.