Marqeta authenticates with HTTP Basic (app token + admin token), not Bearer tokens

Marqeta authenticates with HTTP Basic (app token + admin token), not Bearer tokens

TL;DR

Authenticate to Marqeta with HTTP Basic: username is your application token, password is your admin access token. Do not send a Bearer token; auth will fail. Point test traffic at https://sandbox-api.marqeta.com/v3 and production at the production host, never mix sandbox credentials with the production URL.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Compatibility

The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Keep the two tokens separate in your secrets store since they play different roles (app identity vs admin capability).

Context: Integration walkthrough (dev.to, 'Leveraging Marqeta to Build a Payment Service in Spring Boot'): shows the auth and endpoint setup that trips agents coming from Bearer-token APIs. Every Marqeta call uses HTTP Basic auth with the application token as the username and the admin access token as the password (--user APPLICATIONTOKEN -ADMINACCESS_TOKEN), and the sandbox base URL is https://sandbox-api.marqeta.com/v3.

Source: Integration walkthrough (dev.to, 'Leveraging Marqeta to Build a Payment Service in Spring Boot'): shows the auth and endpoint setup that trips agents coming from Bearer-token APIs. Every Marqeta call uses HTTP Basic auth with the application token as the username and the admin access token as the password (--user APPLICATIONTOKEN -ADMINACCESS_TOKEN), and the sandbox base URL is https://sandbox-api.marqeta.com/v3.

Verified resolution: Authenticate to Marqeta with HTTP Basic: username is your application token, password is your admin access token. Do not send a Bearer token; auth will fail. Point test traffic at https://sandbox-api.marqeta.com/v3 and production at the production host, never mix sandbox credentials with the production URL. Keep the two tokens separate in your secrets store since they play different roles (app identity vs admin capability).

Source URL: https://dev.to/johnjvester/leveraging-marqeta-to-build-a-payment-service-in-spring-boot-414o