Your own credentials

Every pass is signed with an Apple certificate and a Google Wallet issuer. Until you add your own, passes are signed with ours: they're marked as test passes on the pass itself, and your organization has 1,000 operations a month on them, shared by its workspaces. They're for trying the API, never for real customers.

With your own, passes carry your name with Apple and Google, have no test marking, and count only against your plan. Your own credentials come with the Starter plan and above.

Everything below is done in the dashboard, under Credentials, by the workspace's owner. Nothing is done through the API, and no command line is needed: we create and hold your signing key, and never ask you to export one.

Apple Wallet

You need a paid Apple Developer account.

1. Register a Pass Type ID. In Apple Developer, under Identifiers, create a Pass Type ID, such as pass.com.example.loyalty.
2. Download a signing request. On the Credentials screen, choose Download signing request. We make the key pair and keep the private key; you get the request to give Apple.
3. Create the certificate at Apple. Under Certificates, make a Pass Type ID certificate for your identifier, and upload the signing request when Apple asks for one.
4. Upload the certificate. Upload the .cer file Apple gives you. We check that it matches the key we hold, and read your Pass Type ID and Team ID from it.

Passes now sign and install with your certificate.

Updates on Apple devices

To refresh installed passes, add an Apple push key too:

1. In Apple Developer, under Keys, add a key with Apple Push Notification service enabled.
2. Choose Topic-Specific, and select your Pass Type ID. A team-scoped "All Topics" key can be refused by Apple for passes: they install, but never update.
3. Upload the .p8 file with its Key ID and your Team ID.

Without a push key, passes still sign and install, but can't receive updates. Update a pass says so: "apple": "no_push_key".

Google Wallet

1. In the Google Pay & Wallet Console, set up your issuer and note its numeric issuer ID.
2. In Google Cloud, enable the Google Wallet API, create a service account, and give it Developer access to the issuer.
3. Upload the service account's JSON key with the issuer ID. We check it and store it encrypted.

Several issuers

An issuer is who a pass comes from: its own Apple and Google credentials, and optionally its own web address and install page look. A workspace can have more than one, one per brand, department, client or project. Name the issuer when you create a pass:

{ "organizationName": "Acme Coffee", "logoText": "Acme", "issuer": "acme" }

Without issuer, a pass uses the workspace's default issuer. A pass keeps its issuer for life, because holders' phones know it by that identity.

An organization can also share its own issuers with its workspaces. A workspace names one as org: and its slug, such as "issuer": "org:group".

Expiry

An Apple certificate lasts a year. We email the workspace's owner 60, 30, 14 and 7 days before it expires. Renew it for the same Pass Type ID on the same screen, and installed passes keep updating.