diff --git a/src/Client/APIResource.php b/src/Client/APIResource.php
index 3eeb1ee0..aa2b563d 100644
--- a/src/Client/APIResource.php
+++ b/src/Client/APIResource.php
@@ -112,11 +112,12 @@ public function create(array $body, string $uri = '', array $headers = []): ?arr
             $headers
         );
 
+        $request->getBody()->write(json_encode($body));
+
         if ($this->getAuthHandler()) {
             $request = $this->addAuth($request);
         }
 
-        $request->getBody()->write(json_encode($body));
         $this->lastRequest = $request;
 
         $response = $this->getClient()->send($request);
diff --git a/src/Client/Credentials/Handler/TokenBodyHandler.php b/src/Client/Credentials/Handler/TokenBodyHandler.php
index 583ac4eb..bfc622cc 100644
--- a/src/Client/Credentials/Handler/TokenBodyHandler.php
+++ b/src/Client/Credentials/Handler/TokenBodyHandler.php
@@ -11,19 +11,17 @@ class TokenBodyHandler extends AbstractHandler
     public function __invoke(RequestInterface $request, CredentialsInterface $credentials): RequestInterface
     {
         $credentials = $this->extract(Basic::class, $credentials);
-        $body = $request->getBody();
-        $body->rewind();
-        $content = $body->getContents();
-        $params = json_decode($content, true);
 
-        if (!$params) {
-            $params = [];
-        }
+        // We have to do some clunky body pointer rewinding here
+        $existingBody = $request->getBody();
+        $existingBody->rewind();
+        $existingBodyContent = $existingBody->getContents();
+        $existingBody->rewind();
+        $existingBodyArray = json_decode($existingBodyContent, true);
 
-        $params = array_merge($params, $credentials->asArray());
-        $body->rewind();
-        $body->write(json_encode($params));
+        // The request body will now be the existing body plus the basic creds
+        $mergedBodyArray = array_merge($existingBodyArray, $credentials->asArray());
 
-        return $request;
+        return $request->withBody(\GuzzleHttp\Psr7\Utils::streamFor(json_encode($mergedBodyArray)));
     }
 }
diff --git a/src/Verify/ClientFactory.php b/src/Verify/ClientFactory.php
index 26fe0842..0a632fa3 100644
--- a/src/Verify/ClientFactory.php
+++ b/src/Verify/ClientFactory.php
@@ -15,6 +15,7 @@
 use Vonage\Client\APIResource;
 use Vonage\Client\Credentials\Handler\BasicHandler;
 use Vonage\Client\Credentials\Handler\KeypairHandler;
+use Vonage\Client\Credentials\Handler\TokenBodyHandler;
 
 class ClientFactory
 {
@@ -27,7 +28,7 @@ public function __invoke(ContainerInterface $container): Client
             ->setIsHAL(false)
             ->setBaseUri('/verify')
             ->setErrorsOn200(true)
-            ->setAuthHandler(new BasicHandler())
+            ->setAuthHandler(new TokenBodyHandler())
             ->setExceptionErrorHandler(new ExceptionErrorHandler());
 
         return new Client($api);
diff --git a/test/Verify/ClientTest.php b/test/Verify/ClientTest.php
index a226cbbd..54fac1ad 100644
--- a/test/Verify/ClientTest.php
+++ b/test/Verify/ClientTest.php
@@ -58,13 +58,32 @@ public function setUp(): void
             ->setIsHAL(false)
             ->setBaseUri('/verify')
             ->setErrorsOn200(true)
-            ->setAuthHandler(new BasicHandler())
+            ->setAuthHandler(new Client\Credentials\Handler\TokenBodyHandler())
             ->setClient($this->vonageClient->reveal())
             ->setExceptionErrorHandler(new ExceptionErrorHandler());
 
         $this->client = new VerifyClient($api);
     }
 
+    public function testUsesCorrectAuthInBody(): void
+    {
+        $this->vonageClient->send(
+            Argument::that(
+                function (RequestInterface $request) {
+                    $this->assertRequestJsonBodyContains('api_key', 'abc', $request);
+                    $this->assertRequestJsonBodyContains('api_secret', 'def', $request);
+                    $this->assertRequestMatchesUrl('https://api.nexmo.com/verify/psd2/json', $request);
+
+                    return true;
+                }
+            )
+        )->willReturn($this->getResponse('start'))
+                           ->shouldBeCalledTimes(1);
+
+        $request = new RequestPSD2('14845551212', 'Test Verify', '5.25');
+        $response = @$this->client->requestPSD2($request);
+    }
+
     public function testUnserializeAcceptsObject(): void
     {
         $mock = @$this->getMockBuilder(Verification::class)