COconekta
Apple Pay

Create Apple Pay Session

Changed on

Validate an Apple Pay merchant session using Conekta's Apple Pay certificates. Call this endpoint from your backend with the validationURL received in the onvalidatemerchant event and return the response to the browser to complete the merchant validation.

This endpoint does not require authentication, it is meant to be called during the Apple Pay checkout flow.

post/apple_pay/session

Request

Headers

Accept-Language'es' | 'en'

Use for knowing which language to use

Request body

validationURLstring uri required

Validation URL provided by Apple in the onvalidatemerchant event. Only Apple Pay gateway hosts are accepted: https://apple-pay-gateway.apple.com and https://apple-pay-gateway-cert.apple.com.

domainstring

Fully qualified domain where the Apple Pay button is displayed, sent to Apple as the initiative context. It must be a domain previously registered with Conekta. When omitted, the domain configured for the account is used.

source'internal' | 'external'

Origin of the Apple Pay integration requesting the session. external uses the integrator credentials, any other value uses the merchant credentials.

companyIdstring

Apple Pay merchant identifier to validate the session with. When omitted, the merchant identifier configured for the account is used.

Example request

{
  "validationURL": "https://apple-pay-gateway.apple.com/paymentservices/startSession",
  "domain": "pay.conekta.io",
  "source": "external",
  "companyId": "merchant.io.conekta"
}

Response

The validated Apple Pay merchant session.

epochTimestampinteger required

Date and time, in milliseconds since epoch, when the session was created.

expiresAtinteger required

Date and time, in milliseconds since epoch, when the session expires.

merchantSessionIdentifierstring required

Unique identifier of the merchant session generated by Apple.

noncestring required

Single-use value used by Apple to verify the session.

merchantIdentifierstring required

Hashed Apple Pay merchant identifier the session was validated with.

domainNamestring required

Domain the session was validated for.

displayNamestring required

Merchant name shown in the Apple Pay sheet.

signaturestring required

Apple signature of the session, in hexadecimal format.

operationalAnalyticsIdentifierstring

Identifier used by Apple for analytics purposes.

retriesinteger

Number of times the session validation has been retried.

pspIdstring

Payment service provider identifier assigned by Apple.

Example response

{
  "epochTimestamp": 1758222248547,
  "expiresAt": 1758225848547,
  "merchantSessionIdentifier": "SSHC1DDFEB554674D38992774400AE24AB1_916523AAED1343F5BC5815E12BEE9250AFFDC1A17C46B0DE5A943F0F94927C24",
  "nonce": "b94448de",
  "merchantIdentifier": "9358DF186D848FFCE03D9D5230EC85E0E3EA4175C0402A14D32A67504F2C6EBD",
  "domainName": "pay.conekta.io",
  "displayName": "Conekta",
  "signature": "308006092a864886f70d010702a0803080020101310d300b06096086480165030402013080...",
  "operationalAnalyticsIdentifier": "Conekta:9358DF186D848FFCE03D9D5230EC85E0E3EA4175C0402A14D32A67504F2C6EBD",
  "retries": 0,
  "pspId": "9358DF186D848FFCE03D9D5230EC85E0E3EA4175C0402A14D32A67504F2C6EBD"
}

Changes