Kount Authentication: API Security & Credential Management (2026)

Authentication overview

Kount provides fraud detection and prevention services through various APIs, requiring secure authentication for all programmatic interactions. The authentication mechanisms ensure that only authorized entities can submit data or query Kount's systems, safeguarding sensitive transaction information and maintaining the integrity of fraud analysis. Proper authentication is a foundational element for integrating Kount into existing e-commerce platforms and payment gateways, enabling reliable data exchange for real-time risk assessment and account protection.

Kount's approach to API security aligns with industry standards for protecting data in transit and at rest. Developers integrating with Kount's APIs are expected to implement secure coding practices and adhere to credential management guidelines to prevent unauthorized access. This includes using secure protocols like HTTPS and carefully managing API keys and secrets.

Supported authentication methods

Kount primarily supports two main authentication methods for its APIs: API Keys and HMAC (Hash-based Message Authentication Code) signatures. The choice of method often depends on the specific API endpoint being accessed and the required level of security and message integrity.

API Keys

API Keys are unique identifiers used to authenticate a user or application to an API. When making requests to Kount's APIs, an API Key is typically included in the request headers or body. This key serves as a token, granting access to specific functionalities or data based on the permissions associated with the key. API Keys are straightforward to implement and are suitable for many common integration scenarios where the primary concern is identifying the calling application.

HMAC Signatures

HMAC signatures provide a higher level of security by ensuring both the authenticity of the sender and the integrity of the message. Unlike simple API Keys, HMAC involves creating a cryptographic hash of the request payload using a shared secret key. This hash is then sent along with the request. The receiving server (Kount's API) recalculates the hash using its copy of the shared secret and compares it to the received hash. A match confirms that the request originated from an authorized source and that the message content has not been tampered with during transit. HMAC is particularly useful for sensitive transactions where data integrity is paramount, such as payment processing or high-value data submissions.

The IETF RFC 2104 defines the HMAC mechanism, emphasizing its role in message authentication where a shared secret key is used to generate a MAC (Message Authentication Code) to verify data integrity and authenticity IETF HMAC definition.

Authentication Method Comparison

Getting your credentials

To obtain the necessary authentication credentials for Kount APIs, you typically follow these steps:

1. Kount Account Setup: First, you need an active Kount merchant account. This involves contacting Kount sales and completing the onboarding process, which provides access to the Kount Agent Web Console (AWC) or merchant portal.
2. Accessing the Kount Portal: Log in to your Kount Agent Web Console. This web-based interface is where you manage your account settings, view reports, and configure API access.
3. Generating API Keys: Within the Kount portal, navigate to the API or Integration settings section. Here, you will typically find options to generate new API Keys. Kount's documentation provides specific instructions for locating and generating these keys within the interface Kount Support documentation.
4. Managing Shared Secrets (for HMAC): If your integration requires HMAC signatures, you will also manage your shared secret keys within the Kount portal. These secrets are crucial for generating and validating HMACs and should be treated with the highest level of confidentiality.
5. Configuration Details: The Kount portal will provide you with other necessary configuration details, such as your Merchant ID (MID), which is often required alongside API keys or HMAC signatures in API requests.

It is critical to store all generated credentials securely and follow Kount's guidelines for key rotation and access control.

Authenticated request example

While specific API endpoints and request structures vary depending on the Kount API being used (e.g., Kount Central, Kount Command), a common pattern for authentication involves including credentials in the request header or body. Here's a conceptual example using an API Key for a hypothetical Kount API endpoint, followed by an HMAC example.

API Key Example (Conceptual)

In this example, the X-Kount-API-Key header carries the authentication token.

POST /api/v1/orders/validate HTTP/1.1
Host: api.kount.com
Content-Type: application/json
X-Kount-API-Key: YOUR_KOUNT_API_KEY

{
  "merchantId": "YOUR_MID",
  "transactionId": "TRX12345",
  "paymentType": "VISA",
  "amount": 100.00,
  "currency": "USD",
  "email": "[email protected]"
}

HMAC Signature Example (Conceptual)

For HMAC, the request body is signed using a shared secret. The signature is typically included in a header, often alongside a timestamp and a nonce to prevent replay attacks. The server then validates this signature.

POST /api/v1/orders/validate-hmac HTTP/1.1
Host: api.kount.com
Content-Type: application/json
X-Kount-HMAC-Signature: calculated_hmac_signature
X-Kount-Timestamp: 1678886400
X-Kount-Nonce: random_unique_string

{
  "merchantId": "YOUR_MID",
  "transactionId": "TRX12345",
  "paymentType": "VISA",
  "amount": 100.00,
  "currency": "USD",
  "email": "[email protected]"
}

The calculated_hmac_signature would be generated on the client side by hashing the request body, timestamp, and nonce with your shared secret key. Specific implementation details for HMAC generation are provided in Kount's developer documentation Kount developer documentation.

Security best practices

Adhering to security best practices is essential when integrating with Kount's authentication mechanisms to protect your systems and customer data.

• Keep API Keys and Secrets Confidential: Treat API Keys and HMAC shared secrets as highly sensitive credentials, similar to passwords. Never hardcode them directly into client-side code, commit them to public version control repositories, or expose them in client-facing applications. Store them securely in environment variables, secret management services, or encrypted configuration files.
• Use HTTPS for All Communications: Always ensure that all API requests to Kount are made over HTTPS (TLS/SSL). This encrypts data in transit, protecting your credentials and sensitive transaction details from eavesdropping and man-in-the-middle attacks. The Mozilla Developer Network provides comprehensive guidance on secure communication protocols Mozilla secure contexts guide.
• Implement Least Privilege: Configure API Keys with the minimum necessary permissions required for your application's functionality. Avoid using a single, all-powerful key if different parts of your system require access to different Kount API features.
• Regularly Rotate Credentials: Periodically rotate your API Keys and HMAC shared secrets. This practice limits the window of exposure if a credential is ever compromised. Kount's portal should provide mechanisms for generating new keys and deactivating old ones.
• Monitor API Usage: Regularly review API access logs and Kount reports for any unusual activity. Anomalies could indicate attempted unauthorized access or credential compromise.
• Secure Your Development Environment: Ensure that development, staging, and production environments are properly secured. Credentials used in non-production environments should be distinct from production credentials and equally protected.
• Error Handling without Exposure: Design your application's error handling to avoid exposing sensitive information, such as API Keys or internal server errors, in public-facing error messages or logs.
• Consider IP Whitelisting: If Kount supports it, restrict API key usage to a specific set of IP addresses belonging to your servers. This adds another layer of security, preventing unauthorized use of your keys even if they are somehow stolen.