# Authentication

Phone Location Verification v2 supports either Basic Authentication or
Bearer HMAC Authentication.

## Basic Authentication

Send the provisioned merchant username and password in `Authorization` and
include the provisioned `Merchant-Key` header.

## Bearer HMAC Authentication

Send the provisioned Bearer token in `Authorization` and include `Timestamp`
and `Signature`. The signature is the Base64 representation of
`#client_id:#hmac_base64`; calculate the HMAC-SHA256 input from
`timestamp:client_id:POST:body_md5_base64`.

Never expose credentials or signing secrets in client-side applications.