Generate UX Toolkit OAuth access token

POST//

Use this endpoint to generate your UX Toolkit OAuth access token. For details, see Customer Authentication API.

Note
Unlike the other UX Toolkit endpoints, this endpoint is served by the dedicated OAuth host rather than by the UX Toolkit API base URLs listed above. Send the request to https://secure-sandbox.marqeta.com/oauth/token in sandbox, or to https://secure.marqeta.com/oauth/token in production. The audience parameter still identifies the UX Toolkit API. To move an existing integration, see How to migrate UX Toolkit to dedicated OAuth.

Request header

Fields	Description
Content-Type string Required	Media type of the request body. Allowable Values: `application/x-www-form-urlencoded`
DPoP string Required	A valid Demonstrating Proof of Possession (DPoP) JSON Web Token (JWT). Allowable Values: Valid DPoP proof JWT

Request body

Fields	Description
grant_type string Required	Type of OAuth 2.0 grant. Must be set to `client_credentials`. Allowable Values: `client_credentials`
client_assertion_type string Required	Indicates the type of JWT-based client assertion for authentication. Must be set to `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Allowable Values: `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`
client_assertion string Required	Signed JWT that asserts the client’s identity. The header must include the `kid` provided with your client ID. The `aud` claim must be the full token endpoint URL, including the `/oauth/token` path, and the assertion must expire no more than five minutes after it was issued. For more information, see Create your client assertion token. Allowable Values: Valid client assertion
user_token string Optional	Unique identifier of the user account holder. Do not send both `user_token` and `card_token`. If you send `user_token`, the returned access token grants access to all cards that belong to the user. Allowable Values: Existing user token 1-36 chars
card_token string Optional	Unique identifier of the card. Do not send both `card_token` and `user_token`. If you send `card_token`, the returned access token grants access only to the card it belongs to. Allowable Values: Existing card token 1-36 chars
audience string Required	Intended audience of the returned access token. This value should match the base URL of the UX Toolkit API. Allowable Values: `<a href="https://ux-toolkit-api-sandbox.marqeta.com">https://ux-toolkit-api-sandbox.marqeta.com</a>`, `<a href="https://ux-toolkit-api.marqeta.com">https://ux-toolkit-api.marqeta.com</a>`

Note
You can use either user_token or card_token but not both. You can also create an access token with neither to use the onboarding or sign-up form, where the user does not exist yet.

Sample request

cURL

curl --location --request POST 'https://secure-sandbox.marqeta.com/oauth/token' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --header "DPoP: $DPOP_PROOF" \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer' \
  --data-urlencode "client_assertion=$CLIENT_ASSERTION" \
  --data-urlencode 'user_token=some-user-token' \
  --data-urlencode 'audience=https://ux-toolkit-api-sandbox.marqeta.com'

Response body

Fields	Description
access_token string Returned	DPoP-bound JWT that must be passed back to UX Toolkit client via your Customer Authentication API. Allowable Values: Valid access token
expires_in number Returned	Number of seconds for which the returned `access_token` will remain valid. Allowable Values: Any integer
token_type string Returned	Identifies the token type. For DPoP flows, this value is always `DPoP`. Allowable Values: `DPoP`

Sample response body

JSON

{
  "access_token": "eyJhbGciOiJFUzI1NiIsInR5cCI6ImRwb3Arand0IiwiandrIjp7Imt0eSI6IkVDIiwieCI6ImdIM3F5X0xRS3Q3NW9Bejg0R0hhRW5IVUdaVzIydjdFdkhPcmEtSUZqTTAiLCJ5IjoieFlDcDVIUjVHbV90UVBQQ0ZyLU1TUUd1TEYtRkhtbWlEaEl4U3g4MUh6TSIsImNydiI6IlAtMjU2In19.eyJhdGgiOiJ6VVdYc3hicmt6MGtlM0pHQm93UzZRYXVCaVZjWDhPeVY2T3lGQURDT05nIiwiaHR1IjoiaHR0cHM6Ly91eC10b29sa2l0LWFwaS1zYW5kYm94Lm1hcnFldGEuY29tL2FwaS92MS9hdXRoL3Byb2dyYW0tc2hvcnQtY29kZSIsImh0bSI6IkdFVCIsImp0aSI6IjgxNjc2YWQxLTM0MmMtNDZhNi05OTg5LWFiMWFlOWZhZGMxMCIsImlhdCI6MTc0ODkwNTczMSwiZXhwIjoxNzQ4OTA1NzkxfQ.fP3s2El6PlBfJUI-Pc98T6GdPTZgKvFmFnWx75QtOdhTXNJz9RVNEcddIK7YHpbubETcrvs6LZm-vAwZ1B7R1g",
  "token_type": "DPoP",
  "expires_in": 3600
}

Getting Started

Testing

Card Issuing

Card Processing

Accounts & Money Movement

Risk, Fraud, and Disputes

Cardholder User Experience

Generate UX Toolkit OAuth access token

Request header

Request body

Sample request

Response body

Sample response body

​Request header

​Request body

​Sample request

​Response body

​Sample response body

Request header

Request body

Sample request

Response body

Sample response body