Create single-use token

POST///

This endpoint returns a single-use access token. This type of token authorizes a single request to access API endpoints and data associated with a particular user. A single-use access token differs from a user access token (as returned by POST /users/auth/login) only in the number of times it can be used. To return a single-use access token, send a POST request to the /users/auth/onetime endpoint. Provide one of these sets of input data:

Case #1 – Application token and user access token
Case #2 – Application token, admin access token, and user token
Case #3 – Application token, user’s Marqeta password, and user’s email address

In each case, provide the application token as the HTTP Basic Authentication username in the request header’s Authorization field. When applicable, provide the user access token or admin access token as the HTTP Basic Authentication password. When applicable, provide the user token or user’s Marqeta password and email address in JSON format in the request body. Before instantiating an embedded Marqeta widget, call this endpoint to obtain the single-use access token required as input (cases #1 and #2). This endpoint is also useful when you want to check a user’s credentials before performing a sensitive operation without having to log out the user (case #3).

Note
Calling this endpoint and returning a single-use access token does not invalidate the user’s current user access token.

Request body

Fields	Description
email string Optional	Cardholder email address. Required when neither the user token nor the admin access token is provided as the Basic Authentication password (case #3). Allowable Values: 1–255 chars
password string Optional	Password to the cardholder’s user account on the Marqeta platform. Required when neither the user token nor the admin access token is provided as the Basic Authentication password (case #3). Allowable Values: 1–255 chars
user_token string Optional	Identifies the cardholder whose data is accessed. Send a `GET` request to `/users` to retrieve cardholder tokens. Required when the Basic Authentication password is set to an admin access token (case #2). Allowable Values: 1–36 chars

Sample request body

Case 1: Authorization: Basic my_application_token:my_user_access_token

JSON

{}

Case 2: Authorization: Basic my_application_token:my_admin_access_token

JSON

{
  "user_token": "my_user_token"
}

Case 3: Authorization: Basic my_application_token

JSON

{
  "email": "jane.doe@company.com",
  "password": "P@ssw0rd"
}

Response body

Fields	Description
application object Conditionally returned	Contains client application information. Allowable Values: Existing `application` object
application.access_code string Conditionally returned	Access code of the client application. Allowable Values: 255 char max
application.assets_url string Conditionally returned	URL of the client application assets. Allowable Values: 255 char max
application.client_api_base_url string Conditionally returned	Base URL of the client API. Allowable Values: 255 char max
application.environment string Conditionally returned	Client application’s environment. Allowable Values: 255 char max
application.program string Conditionally returned	Name of the program on the Marqeta platform. Allowable Values: 255 char max
application.program_short_code string Conditionally returned	Short code of the program on the Marqeta platform. Allowable Values: 255 char max
application.token string Conditionally returned	Unique identifier of the `application` object. Allowable Values: 36 char max
expires datetime Returned	Date and time when the access token expires. Allowable Values: datetime Format: yyyy-MM-ddThh:mm:ssZ
master_roles array of strings Conditionally returned	Array of master roles. Allowable Values: Valid array of one or more `master_roles` strings
one_time boolean Conditionally returned	Indicates whether the access token is a single-use token. Allowable Values: `true`, `false`
token string Conditionally returned	Unique identifier of the access token. Allowable Values: 36 char max
token_type string Conditionally returned	Specifies the type of access token. Allowable Values: `single_use`, `user`, `admin`
user_token string Conditionally returned	Unique identifier of the user resource. Allowable Values: 36 char max

Sample response body

JSON

{
  "token": "697e0bde-ea52-44bd-8150-0e0f83e9625d",
  "expires": "2024-04-01T00:00:00Z",
  "one_time": true
}

Getting Started

Testing

Card Issuing

Card Processing

Accounts & Money Movement

Risk, Fraud, and Disputes

Cardholder User Experience

Create single-use token

Request body

Sample request body

Response body

Sample response body

​Request body

​Sample request body

​Response body

​Sample response body

Request body

Sample request body

Response body

Sample response body