Create digital wallet token provisioning request for Apple Wallet - Marqeta Docs

POST//

Use this endpoint if Marqeta is your card issuer. If you use Marqeta only for tokenization as a service, use the Tokenization-as-a-Service endpoint instead.

Use this endpoint to return card data for use in provisioning a digital wallet token into Apple Wallet. The returned card data is encrypted using the digital wallet provider’s encryption key, thereby reducing your Payment Card Industry (PCI) compliance overhead.

Request body

Fields	Description
card_token string Required	Unique identifier of the card resource to use for the provisioning request. Allowable Values: 1–36 chars
certificates array of strings Required	Base64-encoded leaf and sub-CA certificates provided by Apple. The first element of the array should be the leaf certificate, followed by the sub-CA. Allowable Values: An array of one or more certificates provided by Apple
device_type string Required	Type of device into which the digital wallet token will be provisioned. Allowable Values: `MOBILE_PHONE`, `WATCH`, `TABLET`
nonce string Required	One-time-use nonce provided by Apple for security purposes. Allowable Values: Base64-encoded nonce from Apple
nonce_signature string Required	Apple-provided signature to the nonce. Allowable Values: Base64-encoded nonce signature from Apple
provisioning_app_version string Required	Version of the application making the provisioning request. Used for debugging and fraud prevention. Allowable Values: 1–50 chars

Sample request body

JSON

{
  "card_token": "my_card_token_1234",
  "device_type": "MOBILE_PHONE",
  "provisioning_app_version": "2.13.7",
  "certificates": [
    "my_certificate_ZIzj...",
    "my_certificate_SgMA..."
  ],
  "nonce": "my_nonce_JJCF",
  "nonce_signature": "my_nonce_signature_wbBn"
}

Response body

Fields	Description
activation_data string Returned	Cryptographic one-time passcode conforming to the payment network operator or service provider specifications. Allowable Values: Any value
card_token string Returned	Unique identifier of the card resource to use for the provisioning request. Allowable Values: 1–36 chars
created_time datetime Returned	Date and time when the digital wallet provisioning request was created, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
encrypted_pass_data string Returned	Payload encrypted with a shared key derived from the Apple Public Certificates and the generated ephemeral private key. Allowable Values: Any value
ephemeral_public_key string Returned	Ephemeral public key used for the provisioning attempt. Allowable Values: Any value
last_modified_time datetime Returned	Date and time when the digital wallet token provisioning request was last updated, in UTC. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ

Sample response body

JSON

{
  "created_time": "2026-03-22T21:22:19Z",
  "last_modified_time": "2026-03-22T21:22:19Z",
  "card_token": "my_card_token_1234",
  "encrypted_pass_data": "my_encrypted_pass_data_KGga...",
  "activation_data": "my_activation_data_VERF...",
  "ephemeral_public_key": "my_ephemeral_public_key_omvw..."
}