Go to the developer center's API Reference page:
https://developer.visaacceptance.com/api-reference-assets/index.html#static-home-section
On the left navigation panel, click
API Endpoints & Authentication
.
Under Authentication and Sandbox Credentials, set the Authentication Type drop-down menu to
JSON Web Token
.
Enter your organization ID in the
Organization
field.
Enter your Password in the
Password
field.
Click
Browse
and upload your p12 certificate from your desktop.
Click
Update Credentials
.
A confirmation message states that your credentials are successfully updated.

On the developer center's left navigation panel, navigate to
Payments >
POST
Process a Payment
.
Under Request: Live Console, click
Send
.

A message confirms that your request was successful with the status code 201.

Log in to the
Business Center
:
https://businesscentertest.visaacceptance.com
On the left navigation panel, navigate to
Transaction Management > Transactions
.
Under Search Results, verify that the request ID from the test authorization response is listed in the Request ID column.
If the test authorization was successful, a success message is present in the corresponding Applications column.

Import your preferred libraries to support MLE. In this example, the configuration uses Java leveraging the open source Nimbus JOSE and Bouncy Castle libraries.

// Nimbus JOSE + JWT
import com.nimbusds.jose.JWEAlgorithm;
import com.nimbusds.jose.JWEHeader;
import com.nimbusds.jose.JWEObject;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSObject;
import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.EncryptionMethod;
import com.nimbusds.jose.Payload;
import com.nimbusds.jose.crypto.RSADecrypter;
import com.nimbusds.jose.crypto.RSAEncrypter;
import com.nimbusds.jose.crypto.RSASSASigner;

// BouncyCastle (PEM parsing + cert conversion)
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.openssl.PEMKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;  

Import the signing, MLE, and SJC certificates. This example uses the P12 certificate as the signing certificate.

public final class KeyPairMaterial {
    public final PrivateKey privateKey;
    public final X509Certificate cert;
    public KeyPairMaterial(PrivateKey k, X509Certificate c) {
        this.privateKey = k;
        this.cert = c;
    }
}

public final class CryptoMaterialDual {
    // Merchant: JWS (REST – Certificate)
    public final KeyPairMaterial signingCert;
    // Merchant: Response decryption (API Response MLE)
    public final KeyPairMaterial responseCert;
    // Platform encryption cert (SJC)
    public final X509Certificate sjcCert;

    public CryptoMaterialDual(KeyPairMaterial signingCert, KeyPairMaterial responseCert, X509Certificate sjcCert) {
        this.signingCert = signingCert;
        this.responseCert = responseCert;
        this.sjcCert = sjcCert;
    }
}

Unpack your imported certificates into a usable format for your system.

Create this method for your system to read your P12 file, if you are using the P12 certificate.

static KeyPairMaterial loadKeyPairFromP12(Path p12Path, char[] password, String keyAlias) throws Exception {
    KeyStore ks = KeyStore.getInstance("PKCS12");
    try (InputStream in = Files.newInputStream(p12Path)) {
        ks.load( in , password);
    }
    KeyStore.PrivateKeyEntry entry = (KeyStore.PrivateKeyEntry) ks.getEntry(
        keyAlias, new KeyStore.PasswordProtection(password));
    return new KeyPairMaterial(entry.getPrivateKey(), (X509Certificate) entry.getCertificate());
}

Create this method for your system to read the PEM chain and private key.

static KeyPairMaterial loadKeyPairFromPem(Path certificateChainPem, String privateKeyPem) throws Exception {
    X509Certificate leaf = readPemCerts(certificateChainPem).get(0);
    PrivateKey key = readPkcs8PrivateKey(privateKeyPem);
    return new KeyPairMaterial(key, leaf);
}

Create this method for your system to read the SJC from the P12 file or PEM chain.

static X509Certificate loadSjcFromP12(Path p12Path, char[] password, String sjcAlias) throws Exception {
    KeyStore ks = KeyStore.getInstance("PKCS12");
    try (InputStream in = Files.newInputStream(p12Path)) {
        ks.load( in , password);
    }
    return (X509Certificate) ks.getCertificate(sjcAlias);
}

static X509Certificate loadSjcFromPem(Path sjcCertPem) throws Exception {
    return readPemCerts(sjcCertPem).get(0);
}

Create this method to include PEM helper functions.

static List < X509Certificate > readPemCerts(Path pemPath) throws Exception {
    try (Reader r = Files.newBufferedReader(pemPath); org.bouncycastle.openssl.PEMParser p = new org.bouncycastle.openssl.PEMParser(r)) {
        var xconv = new org.bouncycastle.cert.jcajce.JcaX509CertificateConverter().setProvider("BC");
        List < X509Certificate > certs = new ArrayList < > ();
        Object o;
        while ((o = p.readObject()) != null) {
            if (o instanceof org.bouncycastle.cert.X509CertificateHolder h) certs.add(xconv.getCertificate(h));
        }
        return certs;
    }
}

static PrivateKey readPkcs8PrivateKey(String pem) throws Exception {
    try (var parser = new org.bouncycastle.openssl.PEMParser(new StringReader(pem))) {
        Object o = parser.readObject();
        var conv = new org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter().setProvider("BC");
        if (o instanceof org.bouncycastle.asn1.pkcs.PrivateKeyInfo pki) return conv.getPrivateKey(pki);
        if (o instanceof org.bouncycastle.openssl.PEMKeyPair kp) return conv.getPrivateKey(kp.getPrivateKeyInfo());
        throw new IllegalArgumentException("Expect PKCS#8 private key PEM");
    }
}

Create these methods as helpers for encrypting and signing.

static String kidFromCert(X509Certificate cert) {
    String dn = cert.getSubjectDN().getName().toUpperCase();
    int i = dn.indexOf("SERIALNUMBER=");
    if (i >= 0) {
        int j = dn.indexOf(",", i);
        if (j < 0) j = dn.length();
        return dn.substring(i + "SERIALNUMBER=".length(), j).trim();
    }
    return cert.getSerialNumber().toString();
}

static String encryptToJwe(String json, X509Certificate sjcCert) throws Exception {
    var header = new com.nimbusds.jose.JWEHeader.Builder(
            com.nimbusds.jose.JWEAlgorithm.RSA_OAEP,
            com.nimbusds.jose.EncryptionMethod.A256GCM)
        .contentType("JWT")
        .keyID(kidFromCert(sjcCert))
        .build();
    var jwe = new com.nimbusds.jose.JWEObject(header, new com.nimbusds.jose.Payload(json));
    jwe.encrypt(new com.nimbusds.jose.crypto.RSAEncrypter((RSAPublicKey) sjcCert.getPublicKey()));
    return jwe.serialize();
}

static String sha256Base64(String body) throws Exception {
    MessageDigest md = MessageDigest.getInstance("SHA-256");
    return Base64.getEncoder().encodeToString(md.digest(body.getBytes(StandardCharsets.UTF_8)));
}

static String signAsJws(String payload, KeyPairMaterial signingCert) throws Exception {
    var header = new com.nimbusds.jose.JWSHeader.Builder(com.nimbusds.jose.JWSAlgorithm.RS256)
        .keyID(kidFromCert(signingCert.cert))
        .type(com.nimbusds.jose.JOSEObjectType.JWT) // typ=JWT
        .build();
    var jws = new com.nimbusds.jose.JWSObject(header, new com.nimbusds.jose.Payload(payload));
    jws.sign(new com.nimbusds.jose.crypto.RSASSASigner(signingCert.privateKey));
    return jws.serialize();
}

static String decryptJwe(String compactJwe, KeyPairMaterial responseCert) throws Exception {
    var jwe = com.nimbusds.jose.JWEObject.parse(compactJwe);
    jwe.decrypt(new com.nimbusds.jose.crypto.RSADecrypter((RSAPrivateKey) responseCert.privateKey));
    return jwe.getPayload().toString();
}

After setting up the above methods in your system, create a class that uses the methods to encrypt and decrypt your payloads with MLE using JWTs.

// Example mix:
// - REST – Certificate from PKCS#12
// - API Response MLE from PEM
// - SJC from PEM
KeyPairMaterial signingCert = loadKeyPairFromP12(
Paths.get("merchant.p12"), "password".toCharArray(), "merchant");
KeyPairMaterial responseCert = loadKeyPairFromPem(
Paths.get("api_response_mle_chain.pem"), Files.readString(Paths.get("api_response_mle_private_key.pem")));
X509Certificate sjc = loadSjcFromPem(Paths.get("sjc_certificate.pem"));

CryptoMaterialDual mat = new CryptoMaterialDual(signingCert, responseCert, sjc);

// 1) Build your request JSON
String requestJson = new org.json.JSONObject()
.put("amount", "10.00")
.put("currency", "USD")
.put("reference", "ORDER-12345")
.toString();

// 2) Encrypt request body to JWE using SJC public cert
String encryptedJwe = encryptToJwe(requestJson, mat.sjcCert);

// 3) Build the HTTP body (this is what you’ll hash for the digest)
String httpBody = new org.json.JSONObject()
.put("encryptedRequest", encryptedJwe)
.toString();

// 4) Build JWS payload: include iat, response kid, digestAlgorithm, and digest of httpBody
String digestB64 = sha256Base64(httpBody);
String jwsPayload = new org.json.JSONObject()
.put("iat", java.time.Instant.now().getEpochSecond())
.put("v-c-api-response-mle-kid", kidFromCert(mat.responseCert.cert))  // instruct server to encrypt to your API Response MLE key
.put("digestAlgorithm", "SHA-256")
.put("digest", digestB64)
.toString();

// 5) Sign the JWS with the REST – Certificate private key
String signedJws = signAsJws(jwsPayload, mat.signingCert);

// 6) Send the HTTP request
// POST /your/api
// Content-Type: application/json
// Authorization: Bearer <signedJws>
/*
Body:
{ "encryptedRequest": "<encryptedJwe>" }
*/

// 7) Handle the response (decrypt if needed with API Response MLE private key)
String apiResponse = /* http call result as string */;
org.json.JSONObject resp = new org.json.JSONObject(apiResponse);
String finalPayload = resp.has("encryptedResponse")
? decryptJwe(resp.getString("encryptedResponse"), mat.responseCert)
: apiResponse;

Log in to the
Business Center
:
https://businesscentertest.visaacceptance.com
On the left navigation panel, choose
Payment Configuration > Key Management
.
If you are using a portfolio account to create a meta key for one of your merchant accounts, you can switch to a merchant account by clicking
Switch merchant
.

The Quick Merchant Switch window appears.
Choose the merchant account ID that you want to switch to. Click
Switch
when done.

In the
Merchant ID
search filter, choose your merchant account ID.
If you logged in from a portfolio user account or the account (
_acct
) level, verify that the merchant ID you choose does not contain
_acct
in the ID name.

Click
+ Generate Key
.
The Create Key page appears.
Choose
REST – Shared Secret
and click
Generate key
.


The Key options window appears.
Check the
Create as a Meta-Key
box and click
Continue
.

Choose one of these options to assign the key:
To assign this key to all accounts in the current portfolio, choose
All current and future Merchant IDs
, click
Create key
, and continue to the Create Key page. All future merchant IDs will be automatically assigned this key. You are done and do not need to proceed with the following steps.
To assign this key to a specific merchant or group of merchants, choose
Custom Merchant ID selection
and then click
Create key
. This key is not automatically assigned to any future merchants. Proceed to the following steps.

Click
+ Add custom merchant ids
. The Add Custom Merchant IDs page appears.
By default, all merchant IDs are shown in the Merchant IDs table. To limit the list to a subset of merchant IDs, click
+ Add filter
, select a search filter from the drop-down menu, and click
Search
.

Use the check boxes to choose one or more transacting MID accounts, and click
Submit
.
The Key Generation page opens.
Click
Create key
.
Continue to the Create Key page to view your new key.
You can also generate a new key by clicking
+ Generate Key
again.

AFTER COMPLETING THE TASK

Log in to the
Business Center
:
https://businesscentertest.visaacceptance.com
On the left navigation panel, choose
Payment Configuration > Key Management
.
In the
Merchant ID
field, choose your portfolio ID if it is not already chosen by default.

Click
+ Generate Key
.
The Create Key page appears.
Choose
REST – Shared Secret
and click
Generate Key
.


The Key options window appears.
Check the
Create as a Meta-Key
box and click
Continue
.

Choose one of these options to assign the key:
To assign this key to all accounts in the current portfolio, choose
All current and future Merchant IDs
, click
Create key
, and continue to the Create Key page. All future merchant IDs will be automatically assigned this key. You are done and do not need to proceed with the following steps.
To assign this key to a specific merchant or group of merchants, choose
Custom Merchant ID selection
and then click
Create key
. This key is not automatically assigned to any future merchants. Proceed to the following steps.

Click
+ Add custom merchant ids
. The Add Custom Merchant IDs page appears.
By default, all merchant IDs are shown in the Merchant IDs table. To limit the list to a subset of merchant IDs, click
+ Add filter
, select a search filter from the drop-down menu, and click
Search
.

Use the check boxes to choose one or more transacting MID accounts, and click
Submit
.
The Key Generation page opens.
Click
Create key
.
Continue to the Create Key page to view your new key.
You can also generate a new key by clicking
+ Generate Key
again.

AFTER COMPLETING THE TASK

Go to the developer center's API Reference page:
https://developer.visaacceptance.com/api-reference-assets/index.html#static-home-section
On the left navigation panel, click
API Endpoints & Authentication
.
Under Authentication and Sandbox Credentials, set the Authentication Type drop-down menu to HTTP Signature.
Enter your organization ID in the Organization ID field.
Enter your key, also known as your private key, in the Key field.
Enter your secret key, also known as your public key, in the Shared Secret Key field.
Click
Update Credentials
.

On the developer center's left navigation panel, navigate to
Payments >
POST
Process a Payment
.
Under Request: Live Console, click
Send
.

A message confirms that your request was successful with the status code 201.

Log in to the
Business Center
:
https://businesscentertest.visaacceptance.com
On the left navigation panel, navigate to
Transaction Management > Transactions
.
Under Search Results, verify that the request ID from the test authorization response is listed in the Request ID column.
If the test authorization was successful, a success message is present in the corresponding Applications column.