---
title: Token Decryption
slug: international-payments/apple-pay/token-decryption
excerpt: >-
  Learn about the options available with Pine Labs Online for decrypting the
  payment token sent by Apple.
hidden: false
sidebar_order: 3
metadata:
  title: Apple Pay Token Decryption – Pine Labs Guide
  description: >-
    The document outlines the importance of token decryption for securely
    processing Apple Pay transactions, offering two main approaches:
    self-managed decryption, which requires technical expertise and PCI
    compliance, and Pine Labs-managed decryption, which simplifies integration
    and reduces technical overhead. Learn how to decrypt Apple Pay payment
    tokens using Pine Labs integration guidelines.
  image: []
  keywords: Apple Pay Token Decription
  robots: index
---
Token decryption is essential for securely retrieving the payment information that Apple Pay encrypts during customer authentication. Apple Pay does not share raw card details; instead, it transmits an encrypted payment token. Decrypting the token allows access to the essential transaction data required to process the payment, including the payment cryptogram and related payment information. This process ensures the secure transmission of sensitive card information and payment authorization.

## Token Decryption Options

There are two main approaches for handling Apple Pay token decryption:

<div className="not-prose card-grid-2">
  <div className="card-grid-item">
    <h3>Self-Managed Apple Pay Token Decryption</h3>
    <p>Take full control of the decryption process with your own infrastructure.</p>
    <p> - Complete control over security implementation.</p>
    <p> - Custom integration with your systems.</p>
    <p> - Requires technical expertise and resources.</p>
  </div>
  <div className="card-grid-item">
    <h3>Pine Labs Online-Managed Apple Pay Token Decryption</h3>
    <p>Let Pine Labs Online handle the decryption process for you.</p>
    <p> - Simplified integration and setup.</p>
    <p> - Managed security and compliance.</p>
    <p> - Reduced technical overhead</p>
  </div>
</div>

## Option A: Self-Managed Apple Pay Token Decryption

You have the option to decrypt the Apple Pay token on your end and then send the decrypted payload to Pine Labs for authorization. This can be done by implementing the below:

1. Integrate the **Apple Pay Web JavaScript SDK** with <a href="integration-steps" >Custom Checkout</a>.

> ❗️ Important:
> 
> - You must have your own **Apple Developer Account** to decrypt Apple Pay token.
> - You need to be **PCI-compliant** to handle decrypted payment data.

### Pre-requisites

If you choose to use your own Apple Developer account, complete the steps below.

1. [Register an Apple Merchant ID](#register-an-apple-merchant-id)
2. [Create the Payment Processing Certificate](#create-payment-processing-certificate)
3. [Create the Merchant Identity Certificate](#create-merchant-identity-certificate)

<h4 id="register-an-apple-merchant-id">1. Register an Apple Merchant ID</h4>

1. Log in to the **Apple Developer Account**.
2. Go to: Certificates, Identifiers & Profiles → Identifiers
3. Click `+` to create a new identifier.
4. Select **Merchant IDs → Continue**.
5. Enter a **unique identifier** and description.
6. Click **Register**.

This Merchant ID must also be used in your iOS app.

<h4 id="create-payment-processing-certificate">2. Create the Payment Processing Certificate</h4>

1. Open your Merchant ID details.
2. Find **Apple Pay Payment Processing Certificate**.
3. Click **Create Certificate**.
4. You will generate the <a href="https://developer.apple.com/help/account/certificates/create-a-certificate-signing-request" target="_blank" >CSR</a> and upload it to the <a href="https://idmsa.apple.com/IDMSWebAuth/signin?appIdKey=891bd3417a7776362562d2197f89480a8547b108fd934911bcbea0110d07f757&path=%2Faccount%2F&rv=1" target="_blank" >Apple Developer Account</a>.
5. Download the signed `.cer` **file**.

<h4 id="create-merchant-identity-certificate">3. Create the Merchant Identity Certificate</h4>

1. In the same Merchant ID settings, locate **Apple Pay Merchant Identity Certificate**.
2. Repeat the same steps as above using the **Merchant Identity CSR**.


Refer to Apple <a href="https://developer.apple.com/documentation/passkit/restoring-the-symmetric-key?language=objc" target="_blank" >Restoring the Symmetric Key</a> documentation to learn more.

Refer to Apple <a href="https://developer.apple.com/documentation/PassKit/payment-token-format-reference?language=objc" target="_blank" >Payment Token Format Reference</a> documentation to learn more.

***

## Option B: Pine Labs Online-Managed Apple Pay Token Decryption

Pine Labs can decrypt the token on your behalf using Apple Pay developer account. You can enable this by integrating through either of the following:

- **Web**: for browser-based or website integrations
- **App**: for mobile application integrations (iOS)

### Web

Pine Labs can decrypt the token on your behalf using Pine Labs Online Apple Pay developer account.

- **Hosted Checkout** – No additional setup needed. Refer to our <a href="integration-steps" >Hosted Checkout documentation</a> to learn more.
- **Custom Checkout** – Refer to our <a href="integration-steps" >Custom Checkout integration documentation</a> to learn more.


<DocImage src="/cdn/img/token-dec-web-1779186301661.png" alt="token-dec-web" caption="" />



### Pre-requisites

If you choose to use Pine Labs Online Apple Pay developer account for Web flow, complete the steps below.

1. [Domain Verification](#domain-verification)
2. [Network Access Requirements](#network-access-requirements)

<h4 id="domain-verification">1. Domain Verification</h4>

1. **Download the verification file** from the Pine Labs dashboard.
2. Place it **exactly** in the path specified (case-sensitive).
3. Domain verification is required for:
   1. Sites using Pine Labs Online Checkout (overlay/iframe)
   2. Sites embedding the Web SDK

**Important Notes**

- The file must be publicly accessible.
- If using a firewall, ensure Apple’s IP addresses are allowed.
- Each domain and subdomain must be verified individually, including:
  - `yourdomain.com`
  - `shop.yourdomain.com`
  - `checkout.yourdomain.com`

To verify your domain, first upload the verification file to your domain. Then, submit your domain in the Active Paymode section of the dashboard under Settings. Please refer the Figure: Pine Labs Online Managed Apple Pay Developer Account for guidance.

<h4 id="network-access-requirements">2. Network Access Requirements</h4>

- The verification file must not be behind access control or authentication.
- File hosting must follow Apple’s exact path and naming conventions.

> 📘 Note:
> 
> - If you only use a website or the Pine Labs Web SDK, you do not need your own Apple Pay developer account.

***

### App

Pine Labs can decrypt the token on your behalf using your Apple Pay developer account. You can enable this by integrating through either of the following:

- **Mobile SDK** - Refer to our <a href="../../sdks/mobile-sdks" >Mobile SDK documentation</a> to learn more.
- **Apple Pay SDK (Standalone)** - Refer to our <a href="sdks" > Apple Pay SDK (Standalone)</a> documentation to learn more.


<DocImage src="/cdn/img/token-dec-app-1779186325474.png" alt="token-dec-app" caption="" />



### Pre-requisites

If you choose to use Pine Labs Online Apple Pay developer account for App flow, complete the steps below.

1. [Register an Apple Merchant ID](#app-register-apple-merchant-id)
2. [Create the Payment Processing Certificate](#app-create-payment-certificate)
3. [Create the Merchant Identity Certificate](#app-create-merchant-identity-certificate)

<h4 id="app-register-apple-merchant-id">1. Register an Apple Merchant ID</h4>

1. Log in to the **Apple Developer Account**.
2. Go to: Certificates, Identifiers & Profiles → Identifiers
3. Click `+` to create a new identifier.
4. Select **Merchant IDs → Continue**.
5. Enter a **unique identifier** and description.
6. Click **Register**.

This Merchant ID must also be used in your iOS app.

<h4 id="app-create-payment-certificate">2. Create the Payment Processing Certificate</h4>

1. Open your Merchant ID details.
2. Find **Apple Pay Payment Processing Certificate**.
3. Click **Create Certificate**.
4. Download the CSR file from the Pine Labs Online dashboard.
5. Upload the CSR file to the Apple Developer account.
6. Download the signed `.cer` **file**.

<h4 id="app-create-merchant-identity-certificate">3. Create the Merchant Identity Certificate</h4>

1. In the same Merchant ID settings, locate **Apple Pay Merchant Identity Certificate**.
2. Repeat the same steps as above using the **Merchant Identity CSR**.
3. Upload both signed certificates to the Pine Labs dashboard.
4. Enter your **Apple Merchant Identifier** and submit.