POST//
Use this endpoint if you use Marqeta only for tokenization as a service and are not a Marqeta card issuer.
If Marqeta is your card issuer, use the Digital Wallets Management endpoint instead.
/digitalwalletprovisionrequests/applepay endpoint to return card data for use in provisioning a digital wallet token into Apple Wallet.
The returned card data is encrypted using the digital wallet provider’s encryption key, thereby reducing your Payment Card Industry (PCI) compliance overhead.
Header parameter
| Fields | Description |
|---|---|
| req-sys-id string Optional | Random pseudo-unique identifier of a request, used for troubleshooting between multiple parties. Usually a globally unique identifier (GUID). Allowable Values: 1–36 chars |
| region string Optional | Region of the card requested for provisioning. Applicable to both physical and virtual cards. Allowable Values: NAM, EMEA, APAC |
| isVirtualCard boolean Optional | Header flag to identify the type of the card requested for provisioning. Value is true for virtual cards, false for physical cards.Allowable Values: Example: true |
Request body
| Fields | Description |
|---|---|
| encrypted_card_data object Required | Encrypted data object. This object is first encrypted using the recipient’s public key and sent in JSON Web Encryption (JWE) format and then signed using the sender’s private key using JSON Web Signature (JWS). It represents the decrypted format. Allowable Values: card_token, card_type, cardholder_info, expiration, metadata, primary_account_number |
| encrypted_card_data.expiration object Required | Specifies the expiry date for the card. Allowable Values: month, year |
| encrypted_card_data.expiration.month string Required | Specifies the expiry month for the card in MM format. 01, for example.Allowable Values: Format: MM |
| encrypted_card_data.expiration.year string Required | Specifies the expiry year for the card in yyyy format. 2024, for example.Allowable Values: Format: yyyy |
| encrypted_card_data.card_token string Optional | Unique identifier of the card. Allowable Values: 1–36 chars |
| encrypted_card_data.primary_account_number string Required | Account number of the card being tokenized. Allowable Values: 12–19 chars |
| encrypted_card_data.card_type string Optional | Specifies the type of card. This field is required for Samsung Wallet. Allowable Values: CREDIT, DEBIT |
| encrypted_card_data.cardholder_info object Optional | Contains personal information about the cardholder. Allowable Values: cardholder_address, email_address, first_name, last_name, phone_number |
| encrypted_card_data.cardholder_info.first_name string Optional | First or given name of the cardholder. Allowable Values: 40 char max |
| encrypted_card_data.cardholder_info.last_name string Optional | Last or family name of the cardholder. Allowable Values: 40 char max |
| encrypted_card_data.cardholder_info.cardholder_address object Optional | Specifies the cardholder’s address. Allowable Values: address_line_1, address_line_2, city, country_code, postal_code, state |
| encrypted_card_data.cardholder_info.cardholder_address.address_line_1 string Required | Street address of the cardholder. Allowable Values: 1–255 chars |
| encrypted_card_data.cardholder_info.cardholder_address.address_line_2 string Optional | Additional address information for the cardholder, such as a suite, floor, room, PO Box or apartment number. Suite 600, for example.Allowable Values: 255 char max |
| encrypted_card_data.cardholder_info.cardholder_address.postal_code string Required | Postal code of the cardholder. Allowable Values: 1–50 chars |
| encrypted_card_data.cardholder_info.cardholder_address.city string Optional | City of the cardholder. Allowable Values: 40 char max |
| encrypted_card_data.cardholder_info.cardholder_address.state string Optional | State or province code associated with the cardholder’s address. Allowable Values: 3 char max |
| encrypted_card_data.cardholder_info.cardholder_address.country_code string Optional | Two-character ISO 3166-1 alpha-2 country code. US, for example.Allowable Values: 2 char max |
| encrypted_card_data.cardholder_info.email_address string Optional | Email address of the cardholder. Allowable Values: 255 char max |
| encrypted_card_data.cardholder_info.phone_number string Optional | Phone number of the cardholder. This number is used when Marqeta performs step-up authentication on your behalf. Allowable Values: 255 char max |
| encrypted_card_data.metadata array of objects Optional | Additional metadata related to the card details object. Allowable Values: Valid array of card details metadata objects |
| encrypted_card_data.metadata[].name string Required | Specifies the metadata attribute name, such as CARD_ART_ID, MAX_TOKENS_PER_CARD, and so on.Allowable Values: 255 char max |
| encrypted_card_data.metadata[].value string Required | Specifies the value of the metadata attribute. Allowable Values: 255 char max |
| card_token string Optional | Unique identifier of the card. Allowable Values: 1–36 chars |
| device_type string Optional | Specifies the type of device. Allowable Values: APPLIANCE, GAMING_DEVICE, LAPTOP, MOBILE_PHONE, MOBILE_PHONE_OR_TABLET, PERSONAL_COMPUTER, TABLET, UNKNOWN, UNRECOGNIZED, VEHICLE, WATCH |
| provisioning_app_version string Optional | Specifies the version of the application making the provisioning request. This field is used for debugging and fraud prevention. Allowable Values: 50 char max |
| certificates array of strings Required | Leaf and sub-CA certificates provided by Apple. Base 64 encoded. The first element of the array should be the leaf certificate, followed by the sub-CA. Allowable Values: 1–8192 chars |
| nonce string Required | One-time-use nonce provided by Apple for security purposes. Allowable Values: 1–32 chars |
| nonce_signature string Required | Apple-provided signature to the nonce. Allowable Values: 1–512 chars |
Sample request body
Sample Apple Pay requestJSON
{
"encrypted_card_data": {
"expiration": {
"month": "01",
"year": "2025"
},
"card_token": "card-token-811",
"primary_account_number": "4111111111111111",
"cardholder_info": {
"first_name": "Jane",
"last_name": "Liu",
"cardholder_address": {
"city": "Oakland",
"state": "CA",
"address_line_1": "180 Grand Ave",
"address_line_2": "Floor 6",
"postal_code": "94612",
"country_code": "US"
},
"email_address": "marqetaTest@marqeta.com",
"phone_number": "1234567890"
}
},
"nonce": "tKVkWRmUTaUiE3zO",
"certificates": [
"MIID/DCCA6OgAwIBAgIIRBkEefDVkQ0wCgYIKoZIzj....",
"MIIC9zCCAnygAwIBAgIIb+/Y9emjp+4wCgYIKoZIzj...."
],
"nonce_signature": "rcQ+z8FCP+jKkgRJ",
"provisioning_app_version": "2.13.7"
}
Response body
| Fields | Description |
|---|---|
| created_time datetime Returned | Date and time when the resource was created, in UTC. Allowable Values: date-time Format: yyyy-MM-ddThh:mm:ssZ |
| last_modified_time datetime Returned | Date and time when the resource was created, in UTC. Allowable Values: date-time Format: yyyy-MM-ddThh:mm:ssZ |
| card_token string Conditionally returned | Unique identifier of the card. Allowable Values: 1–36 chars |
| encrypted_pass_data string Returned | This object is encrypted with a shared key derived from the Apple Public Certificates and the generated ephemeral private key. This is binary data, but is presented here in base64 format. Do not persist this data. Because the scheme and contents could change, they are only subject to the maxLength limit of the NSData object, which is eight exabytes. For more information, see https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615926-encryptedpassdata.Allowable Values: 1–1000000 chars |
| activation_data string Returned | Cryptographic one-time passcode (OTP) conforming to the payment network operator or service provider specifications. This is binary data, but is presented here in base64 format and has no practical max length. For more information, see https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615914-activationdata. Allowable Values: 1–1000000 chars |
| ephemeral_public_key string Returned | Ephemeral public key used for the provisioning attempt. This is binary data, but is presented here in base64 format and has no practical max length. For more information, see https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615952-ephemeralpublickey. Allowable Values: 1–1000000 chars |
Sample response body
Sample Apple Pay responseJSON
{
"created_time": "2026-07-08T16:37:28Z",
"last_modified_time": "2026-07-08T16:37:28Z",
"card_token": "card-token-9",
"encrypted_pass_data": "UnYokfsEG5fQbKPy+4UJ3BF5N0D....",
"activation_data": "TUJQQUMtMS1GSy03NDgwNTIuMS0tVER....",
"ephemeral_public_key": "BCJ++11ucFSG7Z+ZECshFHSFpA...."
}