<p>U.S. Bank downloads and stores cookies on your device when you visit our website. We use these cookies to better understand and improve your browsing experience by identifying most visited pages, personalizing content, and measuring site performance.</p>


Essential cookies enable core functionality such as page navigation and access to secure areas. The website cannot function properly without these cookies; they can only be disabled by changing your browser preferences.

Performance cookies help us to improve our website by collecting and reporting information on its usage (for example, which of our pages are most frequently visited).

Cookie settings

Accounts

Corporate cards

Institutional

Lending

Payments & collections

Transportation

All APIs

API products

Solution Areas

Product Suites

Solutions

Dashboard

Resources and guides

Developers

Support tickets

Contact us

Support

Mutual authentication, or two-way authentication, is a process that requires digital certificates from a mutually trusted certificate authority (CA) to be exchanged to authenticate each party’s identity.

Both parties must be registered with a certificate authority (CA) and configured locally as a trusted party. This security measure reduces the risk of unauthorized use of credentials by threat actors and identity-spoofing schemes.

For more information, please see the [Mutual Transport Layer Security (mTLS) Guide](/mtls-guide/overview). 

API client credentials are used to identify an API application. Applications are required to authenticate via [OAuth 2.0](https://oauth.net/2/) using the [client credentials](https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/) grant type. Credentials are obtained by registering as an API partner.  Once registered, the following credentials will be issued:

| Field name | Value | Description |
| --- | --- | --- |
| Consumer key | string | Unique client identifier or username. This value is used in the authorization header in the authentication request. |
| Consumer secret | string | Unique client secret or password. This value is used in the authorization header in the authentication request. |

**Note**: Credentials must be kept confidential. If compromised, open a [support ticket](/support) immediately to request new credentials.

![Client Credential Grant Flow](/content/dam/developer-portal-solutions/en-us/global/media/images/security-guide/product-oath-image.png)

 

```json
POST /auth/oauth2/v1/token HTTP/1.1
Accept: application/json
Authorization: Basic WkNHWWNDcGtNRFJFSnJTYjB4WHE3dlBJUEhnU1h2S0E6ZjNJbFZpTFBZOGpHbWZsVw==
Content-Type: application/x-www-form-urlencoded
Correlation-Id: 3c49b65a-bdad-481d-b4f8-e69d067d42e8
Content-Length: 29
grant_type=client_credentials
 ``` 

```json
HTTP/1.1 200 OK
Date: Mon, 30 Mar 2020 19:17:25 GMT
Content-Type: application/json
Content-Length: 159
Correlation-Id: 3c49b65a-bdad-481d-b4f8-e69d067d42e8
{
"tokenType": "BearerToken",
"expiresIn": "899",
"accessToken": "EwxKaEeHibaLGRa2cY2DUtcuYDntg8"
}
```

Subsequent API requests must include the accessToken value as the Bearer token in the authorization header. For example:

```json
POST /example/url
Accept: application/json
Authorization: Bearer EwxKaEeHibaLGRa2cY2DUtcuYDntg8
Content-Type: application/json
 ...
```

 

Alliance Offers

Data as a Service

Invitation to Apply

Bank Holidays

Card Activation

Card Controls

Challenge-Widget

Commercial Credit Cards

Commercial Statements

Credit Card Account Details

Credit Card Accounts Overview

Credit Card Alerts

Credit Card Application Status

Credit Card APRs

Credit Card Balance Transfers

Credit Card Disputes

Credit Card Payments

Credit Card Qualified Offers

Credit Card Statements

Credit Card Transactions

Data Sharing for Marketing Purposes

Digital Wallets

Incoming Webhooks

Make a Payment - Coming Soon

Rewards Accelerator

Rewards Automatic Redemption

Rewards: Balance Summary

Rewards: Dashboard

Rewards Redemption Accounts

Rewards Redemptions

Rewards Transactions: Earned and Redeemed

Travel Notifications

User Profile

3DSecure2

CheckoutJs

Commerce SDK

Converge

Disputes Management

Dynamic Currency Conversion

eBoarding

Elavon Cloud Payments Interface

Elavon Payment Gateway

Fusebox

Hosted Payment Page

In Person Payments on Opayo

Leads

Lightbox payment modal

Online Payments on Opayo

Opayo

Opayo Direct

Opayo Forms

Opayo Reporting API

Opayo Server

Opayo Shared API

Payment Method Gateway

Payments Core 365

Simplify

viaconex

XML API

Card as a Service API

Core Banking API

Money Movement API

Reference API

Access Online Transactions

Account Transfers

Account Validation

ACH Originations

Avvance Connect

Avvance Express

Avvance Flex

Bank Information

Card as a Service

Check Payables

Corporate Account Information

Corporate Account Information 3LO

Corporate Credit Cards

Corporate Onboarding

Corporate Statements

Custody

Data Toolbox

Data Toolbox - Accounts

Data Toolbox - Documents

Data Toolbox - Transactions

Debit Card Phone Number Lookup

Disbursements via Zelle®

U.S. Bank Flexible Capital Platform

Freight Payment Customer Profiles

Freight Payment Transactions

Instant payments

Investment Accounting

PaySmart

Payee Choice

Payee Token+

Personal Loans

Positive Pay

Push to Card

Receivables

RTP® - Real-Time Payments

Tokenized Payments

Treasury Builder

U.S. Bank FBO Account

Virtual Account Reporting

Virtual Card Payments

Voyager Accounts

Voyager Cards

Voyager Drivers

Voyager Transactions

Voyager Vehicles

Wire Transfers

Security guide

Security guide

Mutual authentication

API client credentials

OAuth - authorization client credential grant flow

Authentication request

Sample request

Authentication response

Sample response