Get Sandbox Credentials

1. Create a DPC Sandbox login

You’ll enter info about you and your organization and create a password. Then you’ll receive an email with a confirmation link. It may take a few minutes to receive this email.

Create Sandbox login

2. Generate a client token in the Sandbox site

Client tokens are issued to your organization and authenticate your access to the API.

1. Log into the DPC Sandbox.
2. Select New Token.

3. Label the token with a recognizable name. Then select Create token.

4. Copy or download the token displayed on screen.
   This is the only time this client token will be visible. You'll want to save it for later use.
   • Make sure to renew your token every year.
   • When using production data, you'll need to create a token for every organization that works with the API.
5. Choose Go to portal to create your public and private keys.

3. Create a public key

Why we require a public key

Public keys verify that bearer token requests come from an authorized application. They ensure the private key used to sign your JSON Web Token (JWT) matches a public key previously uploaded to DPC.

Steps to create a public key

1. Select Add key from the Sandbox
2. Follow the sequential steps on screen to:
   1. Generate a private key
   2. Generate a public key
   3. Create (and verify) a public key snippet
   4. Generate a verified public key signature

1. Generate a private key

Select copy on the DPC Sandbox site or copy the command invocation here:

openssl genrsa -out private.pem 4096

2. Generate a public key

Select copy on the DPC Sandbox site or copy the command invocation here:

openssl rsa -in private.pem -outform PEM -pubout -out public.pem

3a. Download the snippet.txt file

curl -JLO 'https://raw.githubusercontent.com/CMSgov/dpc-app/main/dpc-web/public/snippet.txt'

3b. Create your public key snippet

openssl dgst -sign private.pem -sha256 -out snippet.txt.sig snippet.txt

4. Generate a verified public key signature

Select copy on the DPC Sandbox site or copy the command invocation below.

openssl base64 -in snippet.txt.sig -out signature.sig

4. Upload your public key in the DPC Sandbox site

1. Go to the Upload Your Public Key section.
2. Create a label for your public key. Make the label easy to recognize.
3. Paste the public.pem file you created into the “Public Key” field.
4. Include BEGIN PUBLIC KEY and END PUBLIC KEY before and after your key.
5. Paste the contents of the signature.sig file you created into the “Signature Snippet” field.
6. Select Add key.

What’s next?

Get a bearer token