---
title: "Create Apple Pay Session"
method: POST
path: "/apple_pay/session"
tags: ["Apple Pay"]
---

# Create Apple Pay Session

`POST /apple_pay/session`

## Request

- Base URL: `https://api.conekta.io`
- URL: `https://api.conekta.io/apple_pay/session`
- Auth: none required
- TypeScript: <https://skmtc.dev/conekta/apis/conekta-api/docs/apple_pay/session/post.ts> (a function with typed inputs; its response is checked against the schema)

Validate an Apple Pay merchant session using Conekta's Apple Pay certificates. Call this
endpoint from your backend with the `validationURL` received in the `onvalidatemerchant`
event and return the response to the browser to complete the merchant validation.

This endpoint does not require authentication, it is meant to be called during the Apple Pay
checkout flow.

## Headers

- `Accept-Language` 'es' | 'en'

## Request body

- ApplePaySessionRequest: Data required to validate an Apple Pay merchant session
  - `validationURL` string, uri, required: Validation URL provided by Apple in the `onvalidatemerchant` event. Only Apple Pay gateway hosts are accepted: `https://apple-pay-gateway.apple.com` and `https://apple-pay-gateway-cert.apple.com`.
  - `domain` string: Fully qualified domain where the Apple Pay button is displayed, sent to Apple as the initiative context. It must be a domain previously registered with Conekta. When omitted, the domain configured for the account is used.
  - `source` 'internal' | 'external': Origin of the Apple Pay integration requesting the session. `external` uses the integrator credentials, any other value uses the merchant credentials.
  - `companyId` string: Apple Pay merchant identifier to validate the session with. When omitted, the merchant identifier configured for the account is used.

## Response `201`

The validated Apple Pay merchant session.

- ApplePaySessionResponse: Apple Pay merchant session returned by Apple. Pass this object as-is to `session.completeMerchantValidation` in the browser.
  - `epochTimestamp` integer, required: Date and time, in milliseconds since epoch, when the session was created.
  - `expiresAt` integer, required: Date and time, in milliseconds since epoch, when the session expires.
  - `merchantSessionIdentifier` string, required: Unique identifier of the merchant session generated by Apple.
  - `nonce` string, required: Single-use value used by Apple to verify the session.
  - `merchantIdentifier` string, required: Hashed Apple Pay merchant identifier the session was validated with.
  - `domainName` string, required: Domain the session was validated for.
  - `displayName` string, required: Merchant name shown in the Apple Pay sheet.
  - `signature` string, required: Apple signature of the session, in hexadecimal format.
  - `operationalAnalyticsIdentifier` string: Identifier used by Apple for analytics purposes.
  - `retries` integer: Number of times the session validation has been retried.
  - `pspId` string: Payment service provider identifier assigned by Apple.

## Other responses

- `422`: parameter validation error
- `500`: internal server error

## Changes

- **2026-11-03** `52f4c0dd8a1b`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/conekta/apis/conekta-api/changes/apple_pay/session/post.md)

---

[API](https://skmtc.dev/conekta/apis/conekta-api.md) - [All operations](https://skmtc.dev/conekta/apis/conekta-api/llms.txt) - [OpenAPI document](https://skmtc.dev/conekta/apis/conekta-api/revisions/52f4c0dd8a1b?raw)