Credentials

Bring your own Apple certificate and Google Wallet issuer. Passes you create are signed and issued under your own identity.

Step by step setup guide

BYOK is not enabled on your account

BYOK lets you sign Apple passes and issue Google Wallet objects under your own developer identity. It isn't self-serve — reach out and we'll enable it.

Talk to us

Apple Wallet

Generate a signing request, get your certificate from Apple, then add a push key.

1

Generate a signing request

We hold the private key for this certificate. It was generated here and has never left our servers.

We create the keypair and keep the private key. You upload the request to Apple to get your Pass Type ID certificate. No Keychain and no openssl needed.

Use a certificate for the same Pass Type ID. Existing passes keep working and re-sign on their next update. Switching to a different pass type is rejected while live passes exist.

Register Pass Type ID Create a Certificate

Request downloaded — upload it to Apple, then come back with the certificate

2

Upload your certificate

Generate a signing request first — Apple issues the certificate from it.

Your certificate is stored and signing passes.

Apple hands back a .cer file. Add it here to finish.

3

Add your push key

Optional

Add your certificate first — the push key is tied to its team.

Push updates are enabled — installed passes receive live updates instantly.

An APNs auth key so pass updates reach installed devices.

Without a push key, installed passes update only when the wallet pulls for changes. They go stale silently, with no error anywhere.
Create an APNs key Your keys

Google Wallet

Your issuer ID and a service account key.

1

Add your issuer ID

The numeric issuer ID from the Google Pay and Wallet Console.

Open the Console

Keep the same issuer ID to rotate the key. Changing it is rejected while live passes exist.

2

Upload your service account key

A service account with Google Wallet Objects access. It must also be authorized on your issuer, or the key authenticates but cannot manage passes.

Enable Wallet API Create service account

Keys are encrypted before they're stored and never shown again.