Skip to content

Apple Pay

Introduction

Apple Pay lets customers pay with the cards stored in their Apple Wallet on iPhone, iPad, Apple Watch and Mac. Authentication happens on the customer's device through Face ID, Touch ID or a passcode, so no card details are typed into your checkout.

Benefits:

  • Customers select a card from Apple Wallet — no manual card entry
  • Device-level authentication reduces fraud and cart abandonment
  • Card details are replaced by a device-specific token, so the real card number is never exposed

Apple Pay branding and acceptable use

If you offer Apple Pay to your customers, you must use the official Apple Pay marks and button assets in compliance with the Apple Pay Marketing Guidelines, the Apple Pay Human Interface Guidelines and the Acceptable Use Guidelines for Apple Pay on the Web, without modifying the assets' colors, proportions or appearance.

Apple Pay availability differs by browser and device

The Apple Pay button only renders in Safari and other Apple Pay-capable browsers on Apple devices. On platforms where Apple Pay is unavailable, present your other payment methods instead — do not show a non-functional button.

Tokenization

Apple Pay does not transmit the real card number. Each transaction carries:

Element Description
DPAN A device-specific account number that substitutes the real PAN. Structurally similar to a card number and specific to the device and wallet.
Cryptogram A one-time value (also called TAVV) generated during device authentication, proving the cardholder authenticated on their device.
ECI The Electronic Commerce Indicator, describing the authentication level achieved.

Because the cryptogram already proves cardholder authentication, Apple Pay transactions are treated as CRYPTOGRAM_3DS — the equivalent of a fully authenticated transaction. See Secure Customer Authentication below.

Supported card brands: the Payment Gateway recognises Visa, Mastercard, Maestro, American Express, Discover and JCB for Apple Pay. The brands actually offered to your customers are those enabled on your terminal and supported by your payment provider — the gateway determines the brand from the token's BIN and validates it against your terminal configuration.

Note that Apple Pay supports Maestro, which Google Pay does not.

Integration Methods

There are two ways to accept Apple Pay through the Payment Gateway.

Method Who decrypts the Apple Pay token Additional development
Wallet Redirect (apple-pay-redirect) The PSP — the gateway never sees the token None to minimal
Network Token (network-token) You, on your own infrastructure Yes — Apple Pay on the Web plus token decryption

Rendering the Apple Pay button on your own checkout

If you need the Apple Pay button inside your own checkout and you want the gateway to decrypt the Apple Pay token on your behalf, contact your account manager — that integration path is not generally available yet. Today, either the PSP renders the wallet sheet (Wallet Redirect) or you decrypt the token yourself (Network Token).

Activation Prerequisites

Before accepting Apple Pay payments, you must:

  1. Submit a request to your account manager to enable Apple Pay on your terminal
  2. Adhere to Apple's policies — comply with the Acceptable Use Guidelines for Apple Pay on the Web and the Apple Pay Marketing Guidelines
  3. For the Network Token method only: enrol with Apple as a merchant, register and verify your domains, and provision your Apple Pay certificates — see Apple Pay on the Web

Wallet Redirect

Wallet Redirect is the simplest option. You select Apple Pay on your platform and the gateway returns a redirect URL to a PSP that renders the Apple Pay sheet and authorizes the payment end to end. The gateway never receives the Apple Pay token, so no Apple merchant enrolment, certificates or domain verification are required on your side — the PSP owns those.

Set payment_method.type to apple-pay-redirect and send payment_method.data as an empty object.

Available through all three integration types:

Integration type Effort Notes
Hosted Payment Page None Apple Pay appears automatically on the HPP once enabled on your terminal
Embedded Fields Minimal The gateway exposes an apple-pay-redirect stub script; your page renders its own "Pay" button
API Integration Low Send one authorize request with payment_method.type set to apple-pay-redirect and follow the returned redirect

Wallet Redirect supports PURCHASE only.

For the full request and response contract, the flow diagrams and the limitations, see Wallet Redirect.

Network Token

If you already run Apple Pay on the Web and decrypt the PKPaymentToken on your own infrastructure, submit the decrypted values through the network-token payment method instead.

Send the DPAN, expiry, cryptogram and ECI, encrypted with your merchant public key, and set source to apple-pay so the origin of the token is recorded:

{
  "payment_method": {
    "type": "network-token",
    "data": {
      "encrypted_token_number": "<encrypted DPAN>",
      "encrypted_expiration_month": "<encrypted MM>",
      "encrypted_expiration_year": "<encrypted YYYY>",
      "encrypted_cryptogram": "<encrypted cryptogram>",
      "eci": "05",
      "source": "apple-pay"
    }
  }
}

No CVV is required — the cryptogram is the authentication proof.

For the complete field reference, the ECI value table and the encryption details, see Network Token.

Secure Customer Authentication (SCA/3DS) and PSD2

Apple Pay transactions arrive already authenticated: the customer authenticated on their device with Face ID, Touch ID or a passcode, and the resulting cryptogram carries that proof. The gateway therefore treats Apple Pay as CRYPTOGRAM_3DS and does not trigger an additional 3DS challenge, which satisfies SCA under PSD2 without a second authentication step for the customer.

Authentication still depends on the data supplied

For the Network Token method, the cryptogram and ECI you send are what establish the authenticated status. If they are missing, the transaction is treated as unauthenticated and may be declined or routed through 3DS by the issuer.