Server-to-Server
With Checkout Page, we handle everything for you — Apple Pay merchant identifiers, certificates, frontend button rendering, and tokenization — all through the hosted checkout. No Apple Pay API integration required on your side. See Checkout Page (Apple Pay) in Optional Services.
With the Server-to-Server integration, your systems decrypt the Apple Pay payment token and handle cardholder data before sending it to OneAPI. You must be fully PCI DSS compliant.
The merchant handles all Apple Pay setup independently and sends the decrypted card data to OneAPI for payment processing.
Merchant Responsibilities
The following are managed entirely by the merchant and are out of scope of OneAPI:
- Apple Pay merchant identifier registration and configuration
- Payment processing certificate creation and management
- Merchant validation (domain verification)
- Frontend integration with the Apple Pay API (rendering the Apple Pay button, handling the payment sheet)
- Receiving and decrypting the Apple Pay payment token
For details on these steps, refer to the official Apple Pay documentation.
What OneAPI Handles
Once the merchant has decrypted the Apple Pay token and extracted the card data, OneAPI is responsible for:
- Processing the payment request with the decrypted card data
- Handling 3DS authentication when required
- Returning the transaction result
- Sending postback notifications with the final payment status
Prerequisites
Before integrating Apple Pay using the Server-to-Server integration, the merchant must complete the following steps:
- Enroll in the Apple Developer Program — A paid membership ($99 USD/year) is required to access Apple Pay configuration. Enroll at https://developer.apple.com/programs/.
- Create a Merchant Identifier — Register a unique merchant identifier in the Apple Developer Portal. This identifier is used across all Apple Pay certificates and sessions.
- Create a Payment Processing Certificate — Generate a CSR, upload it to Apple, and download the certificate. This is used to decrypt Apple Pay payment tokens on your server.
- Create a Merchant Identity Certificate (web only) — Required for TLS mutual authentication during merchant validation on the web. Not needed for in-app integrations.
- Register and verify your domain — Each domain where the Apple Pay button is displayed must be verified by hosting Apple's verification file.
- Complete onboarding with our platform — Contact your onboarding manager to enable Apple Pay processing for your merchant account. You will receive confirmation that your account is configured to accept
payment_type: "applepay"requests. - Integrate the Apple Pay API on your frontend — Implement the Apple Pay button, merchant validation, and token handling on your website or app.
For detailed step-by-step instructions on completing the prerequisites above, see the Merchant Onboarding Guide.
Each authentication flow below includes its own sequence diagram. The Apple Pay overview also shows the typical wallet-cryptogram happy path.
This flow requires full PCI DSS compliance on your side, because decrypted card data passes through your systems before reaching OneAPI.
The merchant sends the decrypted card data to OneAPI via the Payment API. The processing flow depends on whether a wallet cryptogram is available in the decrypted Apple Pay token.
Whether a cryptogram is present in the Apple Pay token depends on Apple Pay, the card network, and the issuing bank — not on OneAPI. This determines whether 3DS authentication is required for the transaction.
Payment flows
Choose the payment flow that matches your decrypted Apple Pay token: