Apple Pay Integration with PAR Pay

Apple Pay Onboarding — Aurus

This guide covers the onboarding procedure for enabling Apple Pay with the Aurus payment gateway. It includes generating the required Apple Pay certificates, converting them into the formats required by Aurus, and securely delivering the certificate artifacts to Aurus.

Note: Successful completion of these steps is a prerequisite for routing Apple Pay transactions through PAR Pay to Aurus.

Scope: This document is limited to gateway onboarding. Apple Pay flow orchestration and API integration with PAR Pay are covered in the Apple Pay Integration with PAR Pay guide.

Certificate Overview

Apple Pay onboarding with Aurus requires two distinct certificate types, each serving a specific purpose:

Certificate Purpose
Payment Processing Certificate Used by Aurus to decrypt the Apple Pay payment token received during a transaction.
Merchant Identity Certificate Used by Aurus to authenticate the merchant with Apple during merchant validation, create Apple Pay merchant sessions, and perform domain verification.

Both certificates are mandatory for Apple Pay enablement.

Apple Merchant Identifier

An Apple Merchant Identifier must be created and approved in the Apple Developer Portal before generating any Apple Pay certificates. For example, merchant.com.yourname.store.

Important: This Merchant ID must be used exactly as the Common Name (CN) in all Apple Pay certificate CSRs.

Certificate Requirements for Aurus

Aurus requires:

  • The Payment Processing Certificate to decrypt Apple Pay payment tokens.
  • The Merchant Identity Certificate to authenticate the merchant and obtain Apple Pay merchant sessions.

Each certificate must be generated using the correct cryptographic algorithm and uploaded under the correct Merchant ID.

Generate Payment Processing Certificate

The business generates encryption material used by Aurus to decrypt Apple Pay payment payloads.

Generate PEM-formatted EC Private Key 

openssl ecparam -name prime256v1 -genkey -noout -out <file_name>.key

Note: Replace <file_name> with your preferred filename. For example, payment_processing.key.

Generate Certificate Signing Request (CSR) 

openssl req -new -key <file_name>.key -out <file_name>.csr

Note: Replace <file_name> with your preferred filename. For example, payment_processing.key. <file_name>.key is the private key and <file_name>.csr is the Certificate Signing Request (CSR).

CSR Prompt Guidelines

  • Common Name (CN): Type your Merchant ID (for example,merchant.com.yourname.store)
  • Email: Corporate email address.
  • Password: Set a password.
  • Other fields: Optional

Upload Certificate Signing Request (CSR) to Apple Developer Portal

Upload the certificate signing request (CSR) using the following navigation path:

  1. Sign in to Apple Developer Portal.
  2. Navigate to Certificates, Identifiers & Profiles.
  3. Open Identifiers > Merchant IDs.
  4. Select your Merchant ID (e.g., merchant.com.yourname.store).
  5. Choose Apple Pay Payment Processing Certificate.
  6. Upload the payment processing CSR (certificate signing request) file (<file_name>.csr).
  7. Download the generated Payment Processing Certificate file (<file_name>.cer).

Convert Downloaded Certificate to PKCS#12 Format 

openssl pkcs12 -export -inkey <file_name>.key -in <file_name>.cer -out <file_name>.p12

Note: Replace <file_name> with your preferred filename. <file_name>.key is the private key, <file_name>.cer is the Apple-issued Payment Processing Certificate, and <file_name>.p12 is a PKCS#12 file that packages the certificate and its matching private key into a single file.

When OpenSSL prompts you to set a password, set and securely store the export password (e.g., PaymentProcessingCertPassword). The example PaymentProcessingCertPassword is just a placeholder to illustrate what kind of value it is. Choose a strong, unique password of your own.

Generate Merchant Identity Certificate

Generate credentials used by Aurus to authenticate the merchant and obtain Apple Pay merchant sessions.

Generate RSA Private Key 

openssl genrsa -out <file_name>.key 2048

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048.

Generate Certificate Signing Request (CSR) 

openssl req -new -key <file_name>.key -out <file_name>.csr

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048.

Certificate Signing Request (CSR) Prompt Guidelines

  • Common Name (CN): Type your Merchant ID (for example,merchant.com.yourname.store)
  • Other fields: Informational only

Upload Certificate Signing Request (CSR) to Apple Developer Portal

Upload the CSR using the following navigation path:

  1. Sign in to Apple Developer Portal
  2. Navigate to Certificates, Identifiers & Profiles.
  3. Open Identifiers > Merchant IDs.
  4. Select your Merchant ID (e.g., merchant.com.yourname.store).
  5. Choose Apple Pay > Create Certificate.
  6. Select Apple Pay Merchant Identity Certificate.
  7. Upload the generated Merchant Identity CSR (certificate signing request) file (<file_name>.csr).
  8. Download the generated Merchant Identity Certificate (<file_name>.cer).

Convert Merchant Identity Certificate to PKCS#12 Format 

openssl pkcs12 -export -inkey <file_name>.key -in <file_name>.cer -out <file_name>.p12

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048.key. <file_name>.key is the private key, <file_name>.cer is the Apple-issued Merchant Identity Certificate, and <file_name>.p12 is a PKCS#12 file that packages the certificate and its matching private key into a single file.

When OpenSSL prompts you to set a password, set and securely store the export password (e.g., MerchantIdentityCertPassword). The example MerchantIdentityCertPassword is just a placeholder to illustrate what kind of value it is. Choose a strong, unique password of your own.

Deliverables to Aurus

Once both Apple Pay certificates have been generated and converted, the following artifacts must be securely delivered to Aurus:

Artifact Purpose
Apple Merchant ID Identifies the merchant for Apple Pay processing.
<file_name>.p12 Payment Processing certificate and private key used by Aurus to decrypt Apple Pay payment tokens
Payment Processing Certificate Password Password protecting the Payment Processing PKCS#12 file
<file_name>.p12 Merchant Identity certificate and private key used by Aurus for merchant validation and Apple Pay merchant session creation
Merchant Identity Certificate Password Password protecting the Merchant Identity PKCS#12 file

Note: Certificate passwords must never be shared via email or ticketing systems. Share them only through an approved secure communication channel.

Certificate Summary

Certificate Used For Required by Aurus
Payment Processing Certificate Decrypting Apple Pay payment tokens Yes
Merchant Identity Certificate Merchant validation and Apple Pay merchant session creation Yes

Installing OpenSSL (Prerequisite)

OpenSSL is required to generate Apple Pay cryptographic materials.

Windows

Verify installation:

openssl version

macOS 

brew install openssl
echo 'export PATH="/opt/homebrew/opt/openssl@3/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc
openssl version

Linux (Ubuntu / Debian) 

sudo apt update
sudo apt install openssl -y
openssl version
Previous
Apple Pay Integration
Next
Apple Pay Onboarding — Spreedly
Copyright © 2026 PAR Technology Corporation. All rights reserved.
PAR Technology Corporation 8383 Seneca Turnpike, Suite 3 New Hartford, New York 13413 (315) 738-0600 legal@partech.com. PAR Tech is a leading global provider of software, systems, and service solutions to the restaurant and retail industries. You may learn about its product offerings here.
Before using this application, please read the PAR Tech Terms of Use. In addition, the sample applications of PAR Technology are licensed under the terms of the O'Saasy License.