# API Authentication

## Choosing an Authentication Option for your POS Solution

GraphQL requests (Braintree In-Person mutations) can be authenticated in one of two ways.

### 1st Party API Caller (API Keys) - Basic Authentication

This is the ideal method if you're developing a custom application for a single merchant or offering a solution in which the merchant is fully responsible for the code calling the API and infrastructure surrounding it. In this model, a merchant logs in to the Braintree Control Panel to [generate API Keys](https://articles.braintreepayments.com/control-panel/important-gateway-credentials#api-keys) (public and private keys), copies and securely stores them, and makes API calls with them as a base64-encoded string, [as outlined here for GraphQL](https://graphql.braintreepayments.com/guides/making_api_calls/#request-requirements).&#x20;

### 3rd Party Application (OAuth) - Bearer Authentication

This is the ideal method if you're developing a single application or codebase leveraged by multiple merchants. This method removes the need for merchants to copy and paste credentials by replacing them with a web-based permission-granting flow within your application.

You will need to [create an OAuth Application](https://developer.paypal.com/braintree/docs/guides/extend/oauth/configuration), [implement the merchant-facing web-based OAuth Flow](https://developers.braintreepayments.com/guides/braintree-auth/overview), and [store the `AccessToken` and `RefreshToken`](https://developer.paypal.com/braintree/docs/guides/extend/oauth/access-tokens) on behalf of each of your merchants. Your application will also need to monitor token expiry and refresh them behind the scenes prior to expiry as needed.&#x20;

{% hint style="warning" %}
You cannot grant 3rd Party permissions to your own account. For testing and development, you will need to [create two Braintree sandbox accounts](https://www.braintreepayments.com/sandbox?locale=us). One account will act as the application owner, and the other account to simulate a test merchant.
{% endhint %}

##
