# MD for: https://www.mercadopago.com.uy/developers/pt/docs/automatic-payments-orders/resources/credentials.md

\# Credentials Credentials are unique access keys that we use to identify an integration in your account. They are directly linked to the application you created for that integration and allow you to securely authenticate operations with Mercado Pago. ## Types of credentials Credentials are divided into \*\*test credentials\*\* and \*\*production credentials\*\*. Use the credentials for the environment you are working in and replace them only when moving from testing to production. :::::TabsComponent ::::TabComponent{title="Test credentials"} ### Test credentials \*\*Test credentials\*\* allow you to configure and validate the integration without processing real operations. They are created automatically with the application. To access them, follow these steps: 1\. Go to \[Integrations\](https://www.mercadopago.com.uy/developers/panel/app) and select the application. 2\. Select \*\*Test\*\* in the environment selector at the top of the screen. 3\. Access the credentials through one of the following options: \* In \*\*Home\*\*, locate the \*\*Credentials\*\* block. \* In the side menu, select \*\*Credentials\*\*. In both cases, you will find the \*\*Public Key\*\* and \*\*Access Token\*\* for the test environment, with options to copy them. | Type | Description | |---|---| | Public Key | Public key used in the \_frontend\_ to initialize the integration and protect the data sent to Mercado Pago. | | Access Token | Private key used in the \_backend\_ to authenticate requests to Mercado Pago APIs. It must never be shared or exposed in the \_frontend\_. | For these integrations, the test \_Access Token\_ starts with the \`APP\_USR\` prefix. Before copying a credential, make sure the selector shows the \*\*Test\*\* environment. On the \*\*Credentials\*\* screen, you will also find a separate block with the test account data and an option to manage it. !\[Access credentials from Home and the side menu\](/images/dashboard/credentials-access-es-v1.png) :::: ::::TabComponent{title="Production credentials"} ### Production credentials \*\*Production credentials\*\* allow you to process real operations. Before using them, you must activate the application's production environment. To activate the production environment and obtain the credentials, follow these steps: 1\. Go to \[Integrations\](https://www.mercadopago.com.uy/developers/panel/app) and select the application. 2\. Click \*\*Credentials\*\* in the side menu. 3\. Select \*\*Production\*\* in the environment selector and click \*\*Activate production environment\*\*. 4\. Enter your business sector and website. 5\. Accept the \[Privacy Statement\](https://www.mercadopago.com.uy/privacidad) and the \[Terms and Conditions\](https://www.mercadopago.com.uy/developers/en/docs/resources/legal/terms-and-conditions). Then, click \*\*Activate\*\*. After activating the environment, you will find the production credentials available for the application: \*\*Public Key\*\*, \*\*Access Token\*\*, \*\*Client ID\*\*, and \*\*Client Secret\*\*. Replace the test Public Key and Access Token with the production credentials before processing real operations. !\[Application production credentials\](/images/dashboard/credentials-production-es-v1.png) The \*\*Public Key\*\* and \*\*Access Token\*\* are used to integrate payments. The \*\*Client ID\*\* and \*\*Client Secret\*\* are mainly used in integrations that implement \[OAuth\](https://www.mercadopago.com.uy/developers/en/docs/security/oauth), especially through the \_Client Credentials\_ flow. | Type | Description | |---|---| | Public Key | Public key linked to an application, used in the \_frontend\_ to initialize the integration during real operations. | | Access Token | Private production key used in the \_backend\_ to authenticate requests to Mercado Pago APIs. It must never be shared or exposed in the \_frontend\_. | | Client ID | Unique identifier that represents the application in integrations that implement OAuth. | | Client Secret | Private key used with the Client ID to authenticate the application. It must never be shared or exposed in the \_frontend\_. | Before copying a credential, make sure the selector shows the \*\*Production\*\* environment. :::: ::::: ## Share credentials If someone is helping you integrate Mercado Pago products, you can securely share the application credentials with them. To start the process, follow these steps: 1\. Go to \[Integrations\](https://www.mercadopago.com.uy/developers/panel/app), select the application, and click \*\*Credentials\*\* in the side menu. 2\. Select the \*\*Test\*\* or \*\*Production\*\* environment. 3\. In the \*\*Share credentials with a developer\*\* section, click \*\*Share credentials\*\*. You can undo this action by deleting the account that received the credentials and renewing them. ## Renew credentials You can renew production credentials for security reasons or to revoke shared access. > WARNING > > Renewing credentials that are already configured will affect the integration. To continue operating, replace the previous credentials with the new ones. Renewal generates a new credential pair. Once completed, replace the previous credentials with the new ones everywhere they are used in the integration. ## Security Recommendations When integrating Mercado Pago solutions, you will handle sensitive data that you must protect from potential losses or vulnerabilities, such as your Mercado Pago access credentials, the keys you use in your integrations, or your customers' information. We will show you how you can optimize the security of your integrations in a simple and quick way. ### Send the Access Token by header Every time you make API calls, send the \*\*Access Token\*\* via \_header\_ instead of \_query param\_. This will allow you to protect it so that it is not exposed to anyone outside your integration. For example, if you perform a \*\*GET\*\* request to the \`/users/me\` resource, it would be like this: \`\`\`curl curl -H 'Authorization: Bearer {{YOUR\_ACCESS\_TOKEN}}' \\ https://api.mercadolibre.com/users/me \`\`\` ### Use OAuth to manage third-party credentials OAuth is an authorization protocol that allows applications to securely access user accounts in HTTP services without requiring the user to directly share their credentials. It works as an intermediary that facilitates controlled access to user data by third-party applications. For more information, access the \[documentation\](https://www.mercadopago.com.uy/developers/en/docs/security/oauth).