A scenario has been known to happen whenever one mouse-swipes some text to select it, then copies it to the clipboard, and then pastes the clipboard to a text entry field -- that the mouse-swipe inadvertently also includes hidden white-space: a tab character, a space character, a newline character.
So, in this scenario, which can and does happen everywhere, extra illegal (invisible) characters was part of the token sent to the Marketplace.