Accept recurring payments with Apple PayAccept recurring payments with Apple Pay in your Kushki integration. Depending on the type of solution you use (Smartlink, Custom Integration, or Direct Apple Pay Integration), the configuration process varies.
Important
🚧 BETA: Limited Availability 🇵🇪 🇨🇱 🇲🇽 Please note that Apple Pay is currently in Beta. This functionality is only available for merchants in Chile, Mexico, and Peru.
If you use Smartlinks, the technical integration is already handled. However, you need to manually enable this option in your Kushki Console.When creating or editing your Smartlink in the Console, select the Subscription or Combined payment type and make sure to enable the Apple Pay toggle under the Payment Methods section.
Note
The Payment Button (Webcheckout) does not support subscriptions, so this option does not apply to that product.
No. For No-Code integrations (Smartlinks) and Custom integrations (libraries and Kajita), you do not need an Apple Developer account.By using Kushki as your processor, we handle the complexity of Apple certificates on your behalf. You only need to host the file we provide to prove that you own the domain.
If you use Kushki.js (v1 or v2 - Hosted Fields) or Kajita, a domain verification is required to ensure your website is authorized to process payments with Apple Pay.Prerequisites: Before getting started, make sure you have access to the Kushki Console, specifically the Configuration module.
Once Kushki provides the file, you must host it on your web server. Apple requires this file to be publicly accessible over HTTPS at a specific path.Create a folder named .well-known at the root of your domain and place the downloaded file there. The final URL should look like this:https://your-domain.com/.well-known/apple-developer-merchantid-domain-associationYou can verify the file is correctly hosted by running the following command in your terminal or simply pasting the URL into your browser:
You should receive a 200 OK response and the file should be downloadable or visible.
Step 3: Register your domain in the Kushki Console#
With the file correctly hosted, the final step is to register your domain on our platform to complete the association.
Log in to the Kushki Console.
Go to Configuration > Integrations.
Find the Apple Pay section.
Enter your domain URL (e.g., your-domain.com) in the corresponding field.
Click Register or Verify.
At this point, Kushki will communicate with Apple to verify that the file exists on your server. If everything is correct, the domain will be verified.
Return to the Apple console (Merchant IDs section), select your ID and click Create Certificate under the Apple Pay Merchant Identity Certificate heading.
Upload the generated merchant_id.csr file and click Continue.
Download the certificate (merchant_id.cer).
Phase 3: Generate the Apple Pay Payment Processing Certificate#
Once the Merchant ID and Merchant Identity Certificate have been generated, you need to obtain a Certificate Signing Request.Follow these steps to obtain the certificate:
1.
Create the EC private key (P-256): Run the following command to generate the processing key:
Once you have your certificates and your domain is verified, proceed with coding the payment button on your website.
Important
For button implementation and further information, refer to the official Apple Pay on the Web guide.
Follow these steps:
Create the Apple Pay Session: Use your Merchant Identity Certificate (generated in Phase 2) to communicate with Apple's servers. This is required to validate your identity and allow the payment sheet (Wallet) to display on the customer's device.
Decrypt the data: Once the customer authorizes the subscription, Apple will return an encrypted payment object. Use the private key from your Payment Processing Certificate (generated in Phase 3) to decrypt this package and obtain the card data (DPAN, cryptogram, etc.).
Tokenize with Kushki: With the decrypted card data, send it to Kushki to generate a secure subscription token.
You must call the endpoint to create a Network Token with the corresponding subscription parameter. Learn how it works in Network Tokens.
Are there special decline codes for Apple Pay transactions? No, because the transaction travels to the card networks through the same card flow, and the same existing decline codes apply.
Are there maximum or minimum transaction amounts? No, there are no specific amount limits imposed by Apple Pay.
Does it work from mobile apps? No. Currently, the functionality is only available for purchases made through web browsers.
Does domain registration need to be done in both UAT (testing) and Production? Yes, Apple requires the domain to be validated in both environments to process payments correctly.
Does 3DS authentication apply to Apple Pay transactions? Apple Pay transactions do not require 3DS because when the card is registered in the wallet, the process is authorized by the Issuer.
Is the subscription token generated with Apple Pay different from a one-time payment token? Yes. By including isSubscription: true in requestApplePayToken, Kushki generates a subscription token that must be used exclusively with the recurring charge endpoint. It is not interchangeable with a one-time payment token.
