Apple Pay supports liability shift globally for all the major Schemes, except for Visa.

The liability shift rules for Visa are defined as following:

• For devices running iOS 16.2 and above, there is global support for all countries.
• For devices running on versions below iOS 16.2, support is only available for cards issued in Europe region (as defined by Visa). 

Liability shift applies only to the Customer-Initiated Transactions (CITs). 
It is not available for Merchant-Initiated Transactions (MITs) since the cardholder is not present in-session for biometrics authentication. 

However in certain scenarios the liability can stay with a Merchant if it was indicated in the Apple Pay payload by providing a specific ECI value. 

Please make sure you only make payment methods available for Apple Pay which are part of your contract with us.

Sequence Diagram

Apple Pay on Your Website

How Apple Pay Works

Similar to other payment buttons, Apple Pay is designed to bypass the typical checkout steps by displaying a comprehensive payment sheet to the customer.

source: Apple

Initiating The Payment Session

Apple Pay on the Web

Apple Pay on the Web utilizes JavaScript APIs integrated into Safari on both Mac and mobile devices. For enhanced security, all Apple Pay sessions must be initiated using the Merchant Identification Certificate. Furthermore, your domains must be whitelisted in the Apple Developer Portal.  

In order to be able to process the transaction with Apple Pay without developer account, you will need to implement a session retrieval process for the onvalidatemerchant event, which would be done against Payone Endpoint  using a generic request.

New Apple Pay on the web without a developer account special parameters 

Sample Session initiation request

Please use the following generic request to retrieve a session against Payone Server API

request="genericpayment"
mid="18323"
portalid="2013224"
key="c839f8eeee77e8621c20f52d31a8a105"
mode="test"
aid="18324"
currency="EUR"
clearingtype="wlt"
reference="PM-APL-304"
lastname="Sørensen"
country="de"
wallettype="APL"
add_paydata[action]="init_applepay_session"
add_paydata[display_name]="testStore"
add_paydata[domain_name]="aTestDomain"'

Sample Session initiation Response

{
    "KeyValueBody": {
        "status": "OK",
        "workorderid": "PP2AADH3T16XW53W",
        "add_paydata[
            applepay_payment_session
        ]": "BASE64_encoded_STRING"
    }
}

Apple Pay Button display 

"For information on displaying the buttons and initiating the payment session, please refer to the Apple documentation: https://developer.apple.com/documentation/apple_pay_on_the_web/displaying_apple_pay_buttons and https://developer.apple.com/documentation/apple_pay_on_the_web/apple_pay_js_api/creating_an_apple_pay_session

Ensure that your payment request is configured correctly to align with your merchant account capabilities. For instance, a basic request for a merchant who can process Mastercard, Visa, and girocard in live mode might look like this:

{
  "countryCode": "DE",
  "currencyCode": "EUR",
  "merchantCapabilities": [
    "supports3DS" // mandatory
  ],
  "supportedNetworks": [
    "visa",
    "masterCard",
        "girocard"
  ],
  "total": {
    "label": "Demo (Card is not charged)",
    "type": "final",
    "amount": "1.99"
  }
}

Handling of Co-Badged Cards

Starting with iOS 15.4, the Apple Pay APIs will honor the order in which the supportedNetworks array is listed. If both networks of a co-badged card are supported by the merchant and the customer’s default card is co-badged, the pre-selected network will be chosen based on the listed order of the networks. This preference affects only the user’s default card (if it’s co-badged), as merchants cannot change the default card selection.

For Mastercard co-badged Girocards, you can specify the preferred network order like this:

"supportedNetworks": [
    "girocard",
    "masterCard",
    "visa"
  ],

"supportedNetworks": [
    "masterCard",
    "girocard",
    "visa"
  ],

Apple Pay In-App

Apple Pay in the App is not supported without Developer Account as this a limitation from Apple. You will need to have your own developer account and implement the regular version of the Apple Pay available from Payone. 

Forwarding the Data to the Payone API

After the customer completes the payment sheet and authenticates using biometric methods (such as Touch ID or Face ID), you'll receive an Apple Pay object like this:

{
   "token":{
      "paymentData":{
         "version":"EC_v1",
         "data":"3+f4oOTwPa6f1UZ6tG...CE=",
         "signature":"MIAGCSqGSIb3DQ...AAAA==",
         "header":{
            "ephemeralPublicKey":"MFkwEK...Md==",
            "publicKeyHash":"l0CnXdMv...D1I=",
            "transactionId":"32b...4f3"
         }
      },
      "paymentMethod":{
         "displayName":"Visa 1234",
         "network":"Visa",
         "type":"debit"
      },
      "transactionIdentifier":"32b...4f3"
   },
   "billingContact":{
      "addressLines":[
         "1 Street",
         ""
      ],
      "administrativeArea":"",
      "country":"United Kingdom",
      "countryCode":"GB",
      "familyName":"Appleseed",
      "givenName":"John",
      "locality":"London",
      "postalCode":"AB12 3CD",
      "subAdministrativeArea":"",
      "subLocality":""
   },
   "shippingContact":{
      "addressLines":[
         "1 Street",
         ""
      ],
      "administrativeArea":"",
      "country":"United Kingdom",
      "countryCode":"GB",
      "familyName":"Appleseed",
      "givenName":"John",
      "locality":"London",
      "postalCode":"AB12 3CD",
      "subAdministrativeArea":"",
      "subLocality":"",
      "phoneNumber":"01234 567890",
      "emailAddress":"john.appleseed@apple.com"
   }
}

Many contents of this object can be mapped to existing Server API parameters.

"billingContact":{
      "addressLines":[
         "1 Street",
         ""
      ],
      "administrativeArea":"",
      "country":"United Kingdom",
      "countryCode":"GB",
      "familyName":"Appleseed",
      "givenName":"John",
      "locality":"London",
      "postalCode":"AB12 3CD",
      "subAdministrativeArea":"",
      "subLocality":""
   },

country=GB
        lastname=Appleseed
        firstname=John
        street=1 Street
        city=London
        zip=AB12 3CD

However, the payment component of the object is encrypted and must be sent to the PAYONE API using specific parameters.

Please note that the token generated by Apple has a limited lifespan of 5 minutes. In live mode (mode=live), PAYONE is required to reject expired tokens. 

Apple Pay Specific Error Messages