Skip to main content

Create a payment without wallet cryptogram — with MPI (direct)

When the cryptogram is not available in the decrypted token, 3DS authentication may be required. If you have your own MPI (Merchant Plug-In), pass the 3DS authentication results directly — the gateway skips its own 3DS verification and returns a direct response.

Payment workflow​

Apple Pay — Server-to-Server (own MPI)
Payer (Customer)
Merchant
Apple Pay
Apple Pay
Card Issuer
OneAPI
1. Initiates transaction
2. Displays Apple Pay button (merchant frontend)
3. Clicks Apple Pay button
Apple Pay authentication (Face ID / Touch ID)
Authenticates payment
4. Encrypted Apple Pay token (no cryptogram)
5. Decrypts token and extracts card data
No wallet cryptogram — merchant runs 3DS with own MPI before calling OneAPI
6. Merchant MPI 3DS authentication request
7. 3DS challenge (redirect)
8. Confirms 3DS challenge
9. 3DS authentication result (to merchant MPI)
10. Payment API request with card data + MPI 3DS results
OneAPI skips its own 3DS and uses the merchant MPI results
11. Payment result (success/declined)
Payment processing occurs asynchronously
12. Postback notification (payment status update)
13. Update order status
14. Display final confirmation

Scroll horizontally if the diagram is wider than your screen.

  1. 1
    Payer (Customer)Merchant

    1. Initiates transaction

  2. 2
    MerchantPayer (Customer)

    2. Displays Apple Pay button (merchant frontend)

  3. 3
    Payer (Customer)Apple PayApple Pay

    3. Clicks Apple Pay button

  4. 4
    Apple PayApple PayPayer (Customer)

    Apple Pay authentication (Face ID / Touch ID)

  5. 5
    Payer (Customer)Apple PayApple Pay

    Authenticates payment

  6. 6
    Apple PayApple PayMerchant

    4. Encrypted Apple Pay token (no cryptogram)

  7. 7
    MerchantMerchant

    5. Decrypts token and extracts card data

  8. Merchant

    No wallet cryptogram — merchant runs 3DS with own MPI before calling OneAPI

  9. 8
    MerchantCard Issuer

    6. Merchant MPI 3DS authentication request

  10. 9
    Card IssuerPayer (Customer)

    7. 3DS challenge (redirect)

  11. 10
    Payer (Customer)Card Issuer

    8. Confirms 3DS challenge

  12. 11
    Card IssuerMerchant

    9. 3DS authentication result (to merchant MPI)

  13. 12
    MerchantOneAPI

    10. Payment API request with card data + MPI 3DS results

  14. OneAPI

    OneAPI skips its own 3DS and uses the merchant MPI results

  15. 13
    OneAPIMerchant

    11. Payment result (success/declined)

  16. OneAPI

    Payment processing occurs asynchronously

  17. 14
    OneAPIMerchant

    12. Postback notification (payment status update)

  18. 15
    MerchantMerchant

    13. Update order status

  19. 16
    MerchantPayer (Customer)

    14. Display final confirmation

POST/rest/payment
payment_typeStringrequired
applepay
order_idStringrequired
Any alphanumeric string to identify the Merchant's order
amountFloatrequired
Amount of the transaction including all taxes and shipping fees
currencyStringrequired
3 letter currency code
postback_urlStringrequired
The URL for updates about transaction status are posted
success_urlStringrequired
Where to redirect the user after a successful transaction
error_urlStringrequired
Where to redirect the user after a failed transaction
card_numberStringrequired
The card number (FPAN) from the decrypted Apple Pay token
card_holderStringrequired
Name of the cardholder
card_expiry_monthStringrequired
Expiry month of the card (1-12)
card_expiry_yearStringrequired
Expiry year of the card (4 digits)
threeds_authentication_valueStringrequired
The 3DS authentication value from the merchant's own MPI
threeds_directory_server_trans_idStringrequired
The Directory Server Transaction ID from the merchant's own MPI. Must be provided together with threeds_authentication_value.
The optional processing parameters from Cardholder Data Parameters such as card_entry, charge_order, clearing_mode, clear_after, and sca_exemption_request are also accepted in this flow.
Example RequestHTTP
POST /rest/payment
Authorization: Basic <base64(api_key:api_password)>
Content-Type: application/json
{
"payment_type": "applepay",
"order_id": "APAY-99999",
"amount": "25.90",
"currency": "EUR",
"postback_url": "https://your-postback.url.com",
"success_url": "https://your-success.url.com",
"error_url": "https://your-error.url.com",
"card_number": "4761070000000509",
"card_holder": "John Doe",
"card_expiry_month": "12",
"card_expiry_year": "2026",
"threeds_authentication_value": "MDAxMDAxMDAxMDAxMDAxMDAxMDA=",
"threeds_directory_server_trans_id": "f25084f0-5b16-4c0a-ae5d-b24e2f921514"
}

Payment API Response​

transaction_idString
ID of the created transaction
payment_typeString
Payment type of the transaction
status_codeInteger
Status code of the transaction
statusString
Status of the transaction
order_idString
Order ID of the transaction
messageString
Optional additional information about the transaction result
additional_transaction_dataString
Additional transaction data provided by you. This will be shown in the dashboard as well as when you query for transaction data. It will also be sent back to your postback_url as part of the postback data.
amountFloat
Amount of the transaction
included_feesString
Included fees for the transaction
error_codeInteger
Error code for the response
Example ResponseJSON
{
"transaction_id": "d1bf9fdf-7268-406f-9e08-8d5a9540ab97",
"payment_type": "applepay",
"status_code": 3,
"status": "completed",
"order_id": "APAY-99999",
"message": null,
"additional_transaction_data": "",
"amount": 25.90,
"included_fees": "0.00",
"error_code": 0
}

Postbacks​

For the full list of payment postback fields, see the Payment API. For retry policy and signature verification, see Postbacks.

Test Data​

To learn how to add test cards for testing Apple Pay, please review the official Apple Pay sandbox testing documentation.

For testing Server-to-Server Apple Pay transactions without a wallet cryptogram using your own MPI, omit threeds_wallet_cryptogram and pass merchant-side 3DS data.

info

The card data in Server-to-Server Apple Pay transactions is actually token data (DPAN), not the real card number — but it follows the same format. CVV is not required for wallet token transactions.

info

3DS is very rare for Apple Pay transactions since the wallet cryptogram typically provides sufficient authentication.

ParameterTest Value
threeds_authentication_valueAUTHENTICATION_VALUE
threeds_directory_server_trans_id54c64c00-eef8-4a8b-af44-fee8cc57e530
card_number5286940020000908
card_holderMax Mustermann
card_expiry_month12
card_expiry_year2026