Merchant Decrypts Apple Pay

You manage the entire Apple Pay experience, including the eligibility check, payment sheet, merchant validation, and token decryption, on your own servers. You send the decrypted payment details to Cashfree only for authorisation.

PCI DSS compliance is required to handle decrypted payment data. Ensure your infrastructure meets PCI DSS requirements before implementing this integration.

Prerequisites

Before implementing Apple Pay with this option, ensure you meet the following requirements.

Active Apple Developer Program membership.
Registered Apple Merchant ID.
HTTPS-enabled website or mobile application.
Valid SSL/TLS certificate.
PCI DSS compliance for handling decrypted payment data.
Apple Pay Payment Processing Certificate.
Merchant Identity Certificate (web only).
Technical capability to implement the Apple Pay SDK.

Set up your Apple Developer account

Complete the following setup process in your Apple Developer account.

Create Apple Merchant ID

Log in to your Apple Developer account.
Navigate to Certificates, Identifiers & Profiles > Identifiers.
Select + to create a new Merchant ID.
Select Merchant IDs and select Continue.
Enter a unique identifier and description.
Select Register to create your Merchant ID.

Create payment processing certificate

In your Merchant ID settings, find Apple Pay Payment Processing Certificate.
Select Create Certificate.
Generate a CSR using OpenSSL:

openssl ecparam -out apple_pay_private.key -name prime256v1 -genkey
openssl req -new -sha256 -key apple_pay_private.key -out apple_pay.csr

Upload the CSR file to Apple.
Download the signed certificate (.cer file).
Store the signed certificate and private key securely on your servers.

Create Merchant Identity Certificate (web only)

In your Merchant ID settings, find Apple Pay Merchant Identity Certificate.
Select Create Certificate.
Generate a CSR using OpenSSL:

openssl req -new -newkey rsa:2048 -nodes -out merchant_id.csr -keyout merchant_id.key

Upload the CSR file to Apple.
Download the signed certificate (.cer file).
Install this certificate on your server. It is used for two-way TLS when calling Apple’s merchant session API.

In your Merchant ID settings, navigate to Merchant Domains.
Add your checkout domains where you want to accept Apple Pay as a payment option.
Download the domain verification file from Apple.
Host the file at this exact path on your domain:

https://<YOUR_DOMAIN>/.well-known/apple-developer-merchantid-domain-association

Select Verify in the Apple Developer portal to register the domains with Apple.

Implement Apple Pay on web and iOS

Implement Apple Pay using the following steps, depending on your platform.

Implement Apple Pay in your web application using the following JavaScript steps:

Check Apple Pay availability

// Check if the Apple Pay JS API is available on this device/browser
if (!window.ApplePaySession) {
  // Apple Pay not supported — hide button
  return;
}

// Check device capability
if (!ApplePaySession.canMakePayments()) {
  // Device does not support Apple Pay
  return;
}

// Check if the customer has an active card in Wallet
const merchantIdentifier = 'merchant.com.yourcompany';
const status = await ApplePaySession.applePayCapabilities(merchantIdentifier);
if (status.paymentCredentialStatus === 'paymentCredentialsAvailable') {
  document.getElementById('apple-pay-button').style.display = 'block';
}

Load the Apple Pay button

<!-- Include the Apple Pay JS SDK -->
<script src="https://applepay.cdn-apple.com/jsapi/1.latest/apple-pay-sdk.js"></script>

<!-- Render the Apple Pay button -->
<apple-pay-button buttonstyle="black" type="buy" locale="en-IN"></apple-pay-button>

Create the payment request and initiate the session

const paymentRequest = {
  countryCode: 'IN',
  currencyCode: 'INR',
  supportedNetworks: ['visa', 'masterCard', 'amex'],
  supportedCountries: ['IN'],
  merchantCapabilities: ['supports3DS', 'supportsCredit', 'supportsDebit'],
  total: {
    label: 'Your Store Name',
    amount: '100.00',
    type: 'final'
  }
};
const session = new ApplePaySession(3, paymentRequest);

Handle merchant validation

Your server calls Apple’s merchant session API directly, using your Merchant Identity Certificate over a two-way TLS connection.

session.onvalidatemerchant = async (event) => {
  // Call your own server to perform merchant validation.
  // Your server uses your Merchant Identity Certificate
  // to make a two-way TLS call to Apple's session API.
  const merchantSession = await fetch('/your-server/validate-merchant', {
    method: 'POST',
    body: JSON.stringify({ validationURL: event.validationURL })
  }).then(r => r.json());
  session.completeMerchantValidation(merchantSession);
};

Handle payment authorisation

After the customer authenticates with Face ID or Touch ID, Apple Pay fires the onpaymentauthorized event with the encrypted payment token. Send the encrypted payment token to your server for decryption.

session.onpaymentauthorized = async (event) => {
  // Send the encrypted token to your server for decryption and Cashfree authorisation.
  const result = await fetch('/your-server/process-apple-pay', {
    method: 'POST',
    body: JSON.stringify({ token: event.payment.token })
  }).then(r => r.json());

  if (result.success) {
    session.completePayment(ApplePaySession.STATUS_SUCCESS);
  } else {
    session.completePayment(ApplePaySession.STATUS_FAILURE);
  }
};

session.begin();

Integrate Apple Pay into your iOS application using Swift and the PassKit framework:

Configure the Xcode project

Open your project in Xcode.
Navigate to Signing & Capabilities.
Add the Apple Pay capability.
Select your Merchant ID in the capabilities section. This is added as a signed entitlement to your app binary.

Check device compatibility

import PassKit

if PKPaymentAuthorizationViewController.canMakePayments(
  usingNetworks: [.visa, .masterCard, .amex]) {
  // Show Apple Pay button
}

Create the payment request

let request = PKPaymentRequest()
request.merchantIdentifier = "merchant.com.yourcompany.app"
request.supportedNetworks = [.visa, .masterCard, .amex]
request.merchantCapabilities = .capability3DS
request.countryCode = "IN"
request.currencyCode = "INR"
request.paymentSummaryItems = [
  PKPaymentSummaryItem(
    label: "Total",
    amount: NSDecimalNumber(string: "100.00")
  )
]

Handle payment authorisation

After the customer authenticates with Face ID or Touch ID, Apple Pay fires the payment authorization callback with the encrypted payment token. Send the encrypted payment token to your server for decryption.

func paymentAuthorizationController(
  _ controller: PKPaymentAuthorizationController,
  didAuthorizePayment payment: PKPayment,
  handler completion: @escaping (PKPaymentAuthorizationResult) -> Void) {
  // Send the token to your server for decryption.
  // Your server decrypts it and calls the Cashfree authorisation API.
  processPaymentOnYourServer(payment.token) { success in
    completion(PKPaymentAuthorizationResult(
      status: success ? .success : .failure,
      errors: nil
    ))
  }
}

Decrypt on your server and authorise via Cashfree

Decrypt the Apple Pay token on your servers, following Apple’s decryption specification.

# Requires: your own Apple Pay decryption implementation, per Apple's specification
def decrypt_apple_pay_token(encrypted_token, private_key):
    # Extract payment data, verify signatures
    # Return decrypted payment details
    pass

After decryption, pass the decrypted fields to process the payment with Cashfree using the Authorisation Only API. Map the decrypted payment data fields received from Apple with the request payload for Cashfree’s Authorisation Only API.

curl --request POST \
  --url https://api.cashfree.com/pg/orders/sessions/authorize \
  --header 'Content-Type: application/json' \
  --header 'x-api-version: 2026-01-01' \
  --data '{
    "payment_session_id": "<payment_session_id>",
    "authorization_data": {
      "authentication_token": "<onlinePaymentCryptogram from decrypted token>",
      "token_number": "<applicationPrimaryAccountNumber from decrypted token>",
      "token_expiry_year": "<expiry year, YY, from applicationExpirationDate>",
      "token_expiry_month": "<expiry month, MM, from applicationExpirationDate>",
      "eci": "<eciIndicator from decrypted token, if provided by wallet>",
      "transaction_type": "APPLE_PAY"
    }
  }'

Enable on the Merchant Dashboard

Complete the following steps to enable Apple Pay for your Merchant ID at Cashfree.

Navigate to Apple Pay settings

Navigate to Settings > Payment Methods > Apple Pay.

Select Merchant Decrypts

Select Custom Checkout > Merchant Decrypts.

Activate

Select Activate. Apple Pay gets enabled for your Merchant ID.

Payments

Payment Gateway

Checkout

International Payments

Flowwise

RiskShield

Subscription

Other Products

Developer updates

Merchant Decrypts Apple Pay

Prerequisites

Set up your Apple Developer account

Implement Apple Pay on web and iOS

Decrypt on your server and authorise via Cashfree

Enable on the Merchant Dashboard

​Prerequisites

​Set up your Apple Developer account

​Implement Apple Pay on web and iOS

​Decrypt on your server and authorise via Cashfree

​Enable on the Merchant Dashboard

Prerequisites

Set up your Apple Developer account

Implement Apple Pay on web and iOS

Decrypt on your server and authorise via Cashfree

Enable on the Merchant Dashboard