> ## Documentation Index
> Fetch the complete documentation index at: https://www.marqeta.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Create single-use token

> This endpoint returns a single-use access token.

POST/users/auth/onetime

This endpoint returns a single-use access token. This type of token authorizes a single request to access API endpoints and data associated with a particular user. A single-use access token differs from a user access token (as returned by `POST` `/users/auth/login`) only in the number of times it can be used.

To return a single-use access token, send a `POST` request to the `/users/auth/onetime` endpoint. Provide one of these sets of input data:

* **Case #1** – Application token and user access token
* **Case #2** – Application token, admin access token, and user token
* **Case #3** – Application token, user's Marqeta password, and user's email address

In each case, provide the application token as the HTTP Basic Authentication username in the request header's Authorization field. When applicable, provide the user access token or admin access token as the HTTP Basic Authentication password. When applicable, provide the user token or user's Marqeta password and email address in [JSON](http://www.json.org/) format in the request body.

Before instantiating an embedded Marqeta widget, call this endpoint to obtain the single-use access token required as input (cases #1 and #2).

This endpoint is also useful when you want to check a user's credentials before performing a sensitive operation without having to log out the user (case #3).

> [!NOTE]
>
> **Note**\
> Calling this endpoint and returning a single-use access token does not invalidate the user's current user access token.

## Request body

| Fields | Description |
| - | - |
| email string  Optional | Cardholder email address. Required when neither the user token nor the admin access token is provided as the Basic Authentication password (case #3). **Allowable Values:**  1–255 chars |
| password string  Optional | Password to the cardholder's user account on the Marqeta platform. Required when neither the user token nor the admin access token is provided as the Basic Authentication password (case #3). **Allowable Values:**  1–255 chars |
| user\_token string  Optional | Identifies the cardholder whose data is accessed. Send a `GET` request to `/users` to retrieve cardholder tokens. Required when the Basic Authentication password is set to an admin access token (case #2). **Allowable Values:**  1–36 chars |

## Sample request body

**Case 1:** Authorization: Basic `my_application_token:my_user_access_token`

```json JSON lines wrap theme={null}
{}
```

**Case 2:** Authorization: Basic `my_application_token:my_admin_access_token`

```json JSON lines wrap theme={null}
{
  "user_token": "my_user_token"
}
```

**Case 3:** Authorization: Basic `my_application_token`

```json JSON lines wrap theme={null}
{
  "email": "jane.doe@company.com",
  "password": "P@ssw0rd"
}
```

## Response body

| Fields | Description |
| - | - |
| application object  Conditionally returned | Contains client application information. **Allowable Values:**  Existing `application` object |
| application.**access\_code** string  Conditionally returned | Access code of the client application. **Allowable Values:**  255 char max |
| application.**assets\_url** string  Conditionally returned | URL of the client application assets. **Allowable Values:**  255 char max |
| application.**client\_api\_base\_url** string  Conditionally returned | Base URL of the client API. **Allowable Values:**  255 char max |
| application.**environment** string  Conditionally returned | Client application's environment. **Allowable Values:**  255 char max |
| application.**program** string  Conditionally returned | Name of the program on the Marqeta platform. **Allowable Values:**  255 char max |
| application.**program\_short\_code** string  Conditionally returned | Short code of the program on the Marqeta platform. **Allowable Values:**  255 char max |
| application.**token** string  Conditionally returned | Unique identifier of the `application` object. **Allowable Values:**  36 char max |
| expires datetime  Returned | Date and time when the access token expires. **Allowable Values:**  datetime **Format:** yyyy-MM-ddThh:mm:ssZ |
| master\_roles array of strings  Conditionally returned | Array of master roles. **Allowable Values:**  Valid array of one or more `master_roles` strings |
| one\_time boolean  Conditionally returned | Indicates whether the access token is a single-use token. **Allowable Values:**  `true`, `false` |
| token string  Conditionally returned | Unique identifier of the access token. **Allowable Values:**  36 char max |
| token\_type string  Conditionally returned | Specifies the type of access token. **Allowable Values:**  `single_use`, `user`, `admin` |
| user\_token string  Conditionally returned | Unique identifier of the user resource. **Allowable Values:**  36 char max |

## Sample response body

```json JSON lines wrap theme={null}
{
  "token": "697e0bde-ea52-44bd-8150-0e0f83e9625d",
  "expires": "2024-04-01T00:00:00Z",
  "one_time": true
}
```


## Related topics

- [Authentication](https://www.marqeta.com/docs/core-api/authentication.md)
- [User Authentication Overview](https://www.marqeta.com/docs/core-api/users/user-authentication.md)
- [Users Overview](https://www.marqeta.com/docs/core-api/users.md)
- [Single-Use BNPL Programs](https://www.marqeta.com/docs/developer-guides/mq-eu-single-use-bnpl.md)
- [Create client access token](https://www.marqeta.com/docs/core-api/users/user-authentication/create-client-access-token.md)