{{tenantCompany}} secures all API communication at two levels: **transport** (`HTTPS` over `TLS 1.2` or newer) and **application** (your chosen authentication model). When onboarding, you select one of two application-level authentication models.

<table>
  <thead>
    <tr>
      <th></th>
      <th>PKCS#7</th>
      <th>JWT</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><strong>Best for</strong></td>
      <td>Existing integrations; maximum payload confidentiality</td>
      <td>New integrations; simpler setup</td>
    </tr>
    <tr>
      <td><strong>Body encryption</strong></td>
      <td>Yes - payload is encrypted end-to-end with PKCS#7</td>
      <td>No - relies on HTTPS/TLS transport encryption</td>
    </tr>
    <tr>
      <td><strong>Key setup</strong></td>
      <td>Generate a CSR → {{tenantCompany}} signs and returns an X.509 certificate</td>
      <td>Generate an RSA key pair → share only the public key</td>
    </tr>
    <tr>
      <td><strong>Request signing</strong></td>
      <td>Payload signed with your private key, encrypted with {{tenantCompany}}'s certificate</td>
      <td>JWT in the <code>Authorization</code> header; body verified via a <code>checksum</code> claim</td>
    </tr>
    <tr>
      <td><strong>Response signing</strong></td>
      <td>Responses signed and encrypted by {{tenantCompany}}</td>
      <td>Responses served as plain HTTPS</td>
    </tr>
    <tr>
      <td><strong>Webhook signing</strong></td>
      <td>Payloads signed and encrypted with PKCS#7</td>
      <td>JWT in the <code>Authorization</code> header</td>
    </tr>
  </tbody>
</table>

Choose **PKCS#7** if you require end-to-end payload encryption beyond the TLS layer, or if you are maintaining an existing integration. Choose **JWT** for new integrations where a light-weight setup is preferred.

### PKCS#7

With PKCS#7, every request payload is signed with your private key and encrypted with {{tenantCompany}}'s public certificate. Every response from {{tenantCompany}} is likewise signed and encrypted, and must be decrypted and verified by you. In practice you need to:

- equip messages with an `X-Request-ID` and look for it in the responses
- [authenticate](/reference/getting-started#authenticate-a-request) every request payload
- [handle](/reference/getting-started#handle-a-response) every response payload

<img src="encryption-and-signing-light.png" alt="PKCS7 authentication diagram"/>

### JWT

With JWT authentication, request integrity is provided by a JSON Web Token that you sign with your RSA private key and include in the `Authorization: Bearer` header. Responses are served as plain `HTTPS` - no application-layer decryption is needed. In practice you need to:

- equip messages with an `X-Request-ID` and look for it in the responses
- [generate and sign a JWT](/reference/getting-started#authenticate-a-request) for every request
- [verify the JWT signature](/reference/payouts#webhooks) on incoming webhooks

<img src="jwt-authentication-light.png" alt="JWT authentication diagram"/>