Apple Pay Onboarding — Spreedly

This guide covers the onboarding procedure for enabling Apple Pay with the Spreedly payment gateway. It includes generating certificate signing requests (CSRs) using Spreedly APIs, completing certificate issuance via the Apple Developer Portal, updating certificates back into Spreedly, and generating the Merchant Identity certificate.

Note: Successful completion of these steps is a prerequisite for routing Apple Pay transactions through PAR Pay to Spreedly.

Scope: This document is limited to gateway onboarding. Apple Pay request flows and PAR Pay orchestration are covered in the Apple Pay Integration with PAR Pay guide.

How Spreedly Handles Apple Pay Certificates

Unlike some gateways, Spreedly:

• Generates the Payment Processing CSR on behalf of the merchant.
• Manages Apple Pay certificates at the environment level.
• Requires the merchant to complete Apple-side certificate issuance and upload the result back to Spreedly.

Both Apple Pay certificate types are required.

Certificate Overview

Apple Merchant Identifier

An Apple Merchant Identifier must exist before generating any Apple Pay certificates. For example, merchant.com.yourname.store. See Generate Merchant Identity Certificate

Important: The Merchant ID must be used exactly as the Common Name (CN) in all Apple Pay certificate CSRs (certificate signing requests).

Generate Payment Processing Certificate (via Spreedly)

Generate and activate the Apple Pay Payment Processing Certificate required by Spreedly to decrypt Apple Pay payment tokens.

Generate Certificate Signing Request (CSR) Using Spreedly API

Call the Spreedly Generate Certificate API:

Endpoint:

POST https://core.spreedly.com/v1/certificates/generate.json

Request Payload:

{
  "certificate": {
    "algorithm": "ec-prime256v1",
    "cn": "merchant.com.yourname.store",
    "email_address": "test@example.com"
  }
}

Extract Certificate Signing Request (CSR) and Certificate Token

From the API response:

• Copy the CSR content from certificate.csr into a .csr file for upload to Apple Developer Portal.
• Copy the unique identifier from certificate.token which uniquely identifies the certificate in Spreedly and is required for subsequent update calls.

Example:

{
  "certificate": {
    "token": "TOKEN_GOES_HERE",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\n..."
  }
}

Create Certificate Signing Request (CSR) File (Windows PowerShell)

@'
-----BEGIN CERTIFICATE REQUEST-----
<CERT CONTENT HERE>
-----END CERTIFICATE REQUEST-----
'@ -replace '\\n', "`n" | Out-File -Encoding ascii `file_name.csr`

Upload Certificate Signing Request (CSR) to Apple Developer Portal

1. Sign in to Apple Developer Portal.
2. Navigate to Certificates, Identifiers & Profiles.
3. Open Identifiers > Merchant IDs.
4. Select your Merchant ID (e.g., merchant.com.yourname.store).
5. Open the Apple Pay section and click Create Certificate.
6. Choose Apple Pay Payment Processing Certificate.
7. Upload the generated payment processing CSR file (<file_name>.csr).
8. Download the generated Payment Processing Certificate file (<file_name>.cer).

Convert Downloaded Certificate to PEM

openssl x509 -inform der -in file_name.cer -out file_name.pem

Note: Replace <file_name> with your preferred filename. For example, payment_processing.cer and payment_processing.pem. <file_name>.cer is the Apple-issued Payment Processing Certificate in DER (binary) format, and <file_name>.pem is the same certificate converted to PEM (Base64-encoded text) format.

Open <file_name>.pem and copy the full certificate string.

Update Certificate in Spreedly

Call the Spreedly Update Certificate API:

Endpoint:

PUT https://core.spreedly.com/v1/certificates/{certificate_token}.xml

Where {certificate_token} is the value returned earlier.

Example:

curl --location --request PUT \
  'https://core.spreedly.com/v1/certificates/2C79XCNP0G9T8VKJ6YTP3YPSDE.xml' \
  --header 'Content-Type: application/xml' \
  --header 'Authorization: Basic <base64-credentials>' \
  --data '<certificate>
    <pem><![CDATA[
-----BEGIN CERTIFICATE-----
<APPLE CERT CONTENT>
-----END CERTIFICATE-----
]]></pem>
  </certificate>'

Generate Merchant Identity Certificate

Generate the Merchant Identity certificate required for Apple Pay merchant validation and merchant session creation.

Important: This certificate is not uploaded to Spreedly. It is used exclusively by the merchant as part of the Apple Pay merchant validation and session creation flow.

Generate RSA Private Key

openssl genrsa -out <file_name>.key 2048

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048.

Generate Certificate Signing Request (CSR)

openssl req -new -key <file_name>.key -out <file_name>.csr

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048. <file_name>.key is the private key and <file_name>.csr is the Certificate Signing Request (CSR).

When prompted:

• Common Name (CN): Type your Merchant ID (for example,merchant.com.yourname.store)
• All other fields: Informational only

Upload Certificate Signing Request (CSR) to Apple Developer Portal

1. Sign in to Apple Developer Portal
2. Navigate to Certificates, Identifiers & Profiles.
3. Open Identifiers > Merchant IDs.
4. Select your Merchant ID (e.g., merchant.com.yourname.store).
5. Choose Apple Pay > Create Certificate.
6. Select Apple Pay Merchant Identity Certificate.
7. Upload the generated Merchant Identity CSR (certificate signing request) file (<file_name>.csr).
8. Download the generated Merchant Identity Certificate (<file_name>.cer).

Convert Merchant Identity Certificate to PKCS#12 / PFX

openssl pkcs12 -export -inkey <file_name>.key -in <file_name>.cer -out <file_name>.p12

Note: Replace <file_name> with your preferred filename. For example, merchant_identity_rsa_2048.key, merchant_id.cer and merchant_identity.p12. <file_name>.key is the private key file, <file_name>.cer is the Merchant Identity Certificate file and <file_name>.p12 is the Private key + Merchant Identity Certificate packaged together.

Optionally create a .pfx copy:

cp <file_name>.p12 <file_name>.pfx

Note: Replace <file_name> with your preferred filename. For example, merchant_identity.p12 and merchant_identity.pfx.

Deliverables to Spreedly