> ## Documentation Index > Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Create digital wallet provisioning request for Apple Wallet > Use the /digitalwalletprovisionrequests/applepay endpoint to return card data for use in provisioning a digital wallet token into Apple Wallet. POST/digitalwalletprovisionrequests/applepay > [!NOTE] > > Use this endpoint if you use Marqeta only for tokenization as a service and are not a Marqeta card issuer. > If Marqeta is your card issuer, use the [Digital Wallets Management endpoint](https://www.marqeta.com/docs/core-api/digital-wallets-management/apple-wallet/create-token-provisioning-request-apple.md) instead. Use the `/digitalwalletprovisionrequests/applepay` endpoint to return card data for use in provisioning a digital wallet token into Apple Wallet. The returned card data is encrypted using the digital wallet provider's encryption key, thereby reducing your Payment Card Industry (PCI) compliance overhead. ## Header parameter | Fields | Description | | - | - | | req-sys-id string Optional | Random pseudo-unique identifier of a request, used for troubleshooting between multiple parties. Usually a globally unique identifier (GUID). **Allowable Values:** 1–36 chars | | region string Optional | Region of the card requested for provisioning. Applicable to both physical and virtual cards. **Allowable Values:** `NAM`, `EMEA`, `APAC` | | isVirtualCard boolean Optional | Header flag to identify the type of the card requested for provisioning. Value is `true` for virtual cards, `false` for physical cards. **Allowable Values:** Example: `true` | ## Request body | Fields | Description | | - | - | | encrypted\_card\_data object Required | Encrypted data object. This object is first encrypted using the recipient's public key and sent in [JSON Web Encryption (JWE) format](https://openid.net/specs/draft-jones-json-web-encryption-02.html) and then signed using the sender's private key using [JSON Web Signature (JWS)](https://openid.net/specs/draft-jones-json-web-signature-04.html). It represents the decrypted format. **Allowable Values:** `card_token`, `card_type`, `cardholder_info`, `expiration`, `metadata`, `primary_account_number` | | encrypted\_card\_data.**expiration** object Required | Specifies the expiry date for the card. **Allowable Values:** `month`, `year` | | encrypted\_card\_data.expiration.**month** string Required | Specifies the expiry month for the card in MM format. `01`, for example. **Allowable Values:** Format: MM | | encrypted\_card\_data.expiration.**year** string Required | Specifies the expiry year for the card in yyyy format. `2024`, for example. **Allowable Values:** Format: yyyy | | encrypted\_card\_data.**card\_token** string Optional | Unique identifier of the card. **Allowable Values:** 1–36 chars | | encrypted\_card\_data.**primary\_account\_number** string Required | Account number of the card being tokenized. **Allowable Values:** 12–19 chars | | encrypted\_card\_data.**card\_type** string Optional | Specifies the type of card. This field is required for Samsung Wallet. **Allowable Values:** `CREDIT`, `DEBIT` | | encrypted\_card\_data.**cardholder\_info** object Optional | Contains personal information about the cardholder. **Allowable Values:** `cardholder_address`, `email_address`, `first_name`, `last_name`, `phone_number` | | encrypted\_card\_data.cardholder\_info.**first\_name** string Optional | First or given name of the cardholder. **Allowable Values:** 40 char max | | encrypted\_card\_data.cardholder\_info.**last\_name** string Optional | Last or family name of the cardholder. **Allowable Values:** 40 char max | | encrypted\_card\_data.cardholder\_info.**cardholder\_address** object Optional | Specifies the cardholder's address. **Allowable Values:** `address_line_1`, `address_line_2`, `city`, `country_code`, `postal_code`, `state` | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**address\_line\_1** string Required | Street address of the cardholder. **Allowable Values:** 1–255 chars | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**address\_line\_2** string Optional | Additional address information for the cardholder, such as a suite, floor, room, PO Box or apartment number. `Suite 600`, for example. **Allowable Values:** 255 char max | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**postal\_code** string Required | Postal code of the cardholder. **Allowable Values:** 1–50 chars | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**city** string Optional | City of the cardholder. **Allowable Values:** 40 char max | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**state** string Optional | State or province code associated with the cardholder's address. **Allowable Values:** 3 char max | | encrypted\_card\_data.cardholder\_info.cardholder\_address.**country\_code** string Optional | Two-character [ISO 3166-1 alpha-2 country code](https://www.iso.org/iso-3166-country-codes.html). `US`, for example. **Allowable Values:** 2 char max | | encrypted\_card\_data.cardholder\_info.**email\_address** string Optional | Email address of the cardholder. **Allowable Values:** 255 char max | | encrypted\_card\_data.cardholder\_info.**phone\_number** string Optional | Phone number of the cardholder. This number is used when Marqeta performs step-up authentication on your behalf. **Allowable Values:** 255 char max | | encrypted\_card\_data.**metadata** array of objects Optional | Additional metadata related to the card details object. **Allowable Values:** Valid array of card details metadata objects | | encrypted\_card\_data.metadata\[].**name** string Required | Specifies the metadata attribute name, such as `CARD_ART_ID`, `MAX_TOKENS_PER_CARD`, and so on. **Allowable Values:** 255 char max | | encrypted\_card\_data.metadata\[].**value** string Required | Specifies the value of the metadata attribute. **Allowable Values:** 255 char max | | card\_token string Optional | Unique identifier of the card. **Allowable Values:** 1–36 chars | | device\_type string Optional | Specifies the type of device. **Allowable Values:** `APPLIANCE`, `GAMING_DEVICE`, `LAPTOP`, `MOBILE_PHONE`, `MOBILE_PHONE_OR_TABLET`, `PERSONAL_COMPUTER`, `TABLET`, `UNKNOWN`, `UNRECOGNIZED`, `VEHICLE`, `WATCH` | | provisioning\_app\_version string Optional | Specifies the version of the application making the provisioning request. This field is used for debugging and fraud prevention. **Allowable Values:** 50 char max | | certificates array of strings Required | Leaf and sub-CA certificates provided by Apple. Base 64 encoded. The first element of the array should be the leaf certificate, followed by the sub-CA. **Allowable Values:** 1–8192 chars | | nonce string Required | One-time-use nonce provided by Apple for security purposes. **Allowable Values:** 1–32 chars | | nonce\_signature string Required | Apple-provided signature to the nonce. **Allowable Values:** 1–512 chars | ## Sample request body Sample Apple Pay request ```json JSON expandable lines wrap theme={null} { "encrypted_card_data": { "expiration": { "month": "01", "year": "2025" }, "card_token": "card-token-811", "primary_account_number": "4111111111111111", "cardholder_info": { "first_name": "Jane", "last_name": "Liu", "cardholder_address": { "city": "Oakland", "state": "CA", "address_line_1": "180 Grand Ave", "address_line_2": "Floor 6", "postal_code": "94612", "country_code": "US" }, "email_address": "marqetaTest@marqeta.com", "phone_number": "1234567890" } }, "nonce": "tKVkWRmUTaUiE3zO", "certificates": [ "MIID/DCCA6OgAwIBAgIIRBkEefDVkQ0wCgYIKoZIzj....", "MIIC9zCCAnygAwIBAgIIb+/Y9emjp+4wCgYIKoZIzj...." ], "nonce_signature": "rcQ+z8FCP+jKkgRJ", "provisioning_app_version": "2.13.7" } ``` ## Response body | Fields | Description | | - | - | | created\_time datetime Returned | Date and time when the resource was created, in UTC. **Allowable Values:** date-time **Format:** yyyy-MM-ddThh:mm:ssZ | | last\_modified\_time datetime Returned | Date and time when the resource was created, in UTC. **Allowable Values:** date-time **Format:** yyyy-MM-ddThh:mm:ssZ | | card\_token string Conditionally returned | Unique identifier of the card. **Allowable Values:** 1–36 chars | | encrypted\_pass\_data string Returned | This object is encrypted with a shared key derived from the Apple Public Certificates and the generated ephemeral private key. This is binary data, but is presented here in base64 format. Do not persist this data. Because the scheme and contents could change, they are only subject to the `maxLength` limit of the NSData object, which is eight exabytes. For more information, see [[https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615926-encryptedpassdata](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615926-encryptedpassdata)](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615926-encryptedpassdata). **Allowable Values:** 1–1000000 chars | | activation\_data string Returned | Cryptographic one-time passcode (OTP) conforming to the payment network operator or service provider specifications. This is binary data, but is presented here in base64 format and has no practical max length. For more information, see [[https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615914-activationdata](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615914-activationdata)](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615914-activationdata). **Allowable Values:** 1–1000000 chars | | ephemeral\_public\_key string Returned | Ephemeral public key used for the provisioning attempt. This is binary data, but is presented here in base64 format and has no practical max length. For more information, see [[https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615952-ephemeralpublickey](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615952-ephemeralpublickey)](https://developer.apple.com/documentation/passkit/pkaddpaymentpassrequest/1615952-ephemeralpublickey). **Allowable Values:** 1–1000000 chars | ## Sample response body Sample Apple Pay response ```json JSON expandable lines wrap theme={null} { "created_time": "2026-07-08T16:37:28Z", "last_modified_time": "2026-07-08T16:37:28Z", "card_token": "card-token-9", "encrypted_pass_data": "UnYokfsEG5fQbKPy+4UJ3BF5N0D....", "activation_data": "TUJQQUMtMS1GSy03NDgwNTIuMS0tVER....", "ephemeral_public_key": "BCJ++11ucFSG7Z+ZECshFHSFpA...." } ``` ## Related topics - [Digital Wallet Provisioning Requests Overview](https://www.marqeta.com/docs/core-api/tokenization-as-a-service/provisioning-requests.md) - [Tokenization-as-a-Service Overview](https://www.marqeta.com/docs/core-api/tokenization-as-a-service.md) - [Create digital wallet token provisioning request for Apple Wallet](https://www.marqeta.com/docs/core-api/digital-wallets-management/apple-wallet/create-token-provisioning-request-apple.md) - [Create request for Apple Wallet web push provisioning](https://www.marqeta.com/docs/core-api/digital-wallets-management/apple-wallet/create-request-apple-web-push-provisioning.md) - [Provisioning Digital Wallet Tokens](https://www.marqeta.com/docs/developer-guides/provisioning-digital-wallet-tokens.md)