Merchant-Managed Apple Pay Decryption

Overview

By default, Coinflow handles the decryption of Apple Pay payment tokens on your behalf using certificates you provide. However, some merchants prefer to manage their own Apple Pay token decryption, for example, when they need to inspect or validate the token data before submitting it for payment processing.

With Merchant-Managed Decryption, you decrypt the Apple Pay token on your own server and pass the decrypted token data directly to Coinflow’s checkout API. Coinflow skips its own decryption step and processes the payment using the data you provide.

When to Use This

Use merchant-managed decryption when:

• You already decrypt Apple Pay tokens on your own server for other purposes (e.g., fraud analysis, logging, multi-processor routing)
• You need full control over the decryption process and key management
• Your infrastructure requires inspecting the decrypted token before submitting it for processing

Prerequisites

Before integrating merchant-managed decryption, ensure you have:

1. An active Apple Pay integration with Coinflow
2. Your own Apple Pay Payment Processing Certificate and private key for decrypting tokens (see How to Generate Apple Pay Certificates)
3. The Merchant-Managed Decryption feature enabled on your Coinflow account

Integration

1
// Example: Apple Pay checkout request with a pre-decrypted token
2
// NOTE: The values below are EXAMPLES only and do not reflect real production values.
3
const checkoutRequest = {
4
  subtotal: { cents: 1000, currency: "USD" },
5
  applePayPayment: {
6
    // Standard Apple Pay payment data from the Apple Pay SDK
7
    token: {
8
      paymentData: { /* ... encrypted payment data ... */ },
9
      paymentMethod: {
10
        displayName: "Visa 1234",
11
        network: "Visa",
12
        type: "debit"
13
      },
14
      transactionIdentifier: "ABC123..."
15
    },
16
    billingContact: {
17
      givenName: "Jane",
18
      familyName: "Doe",
19
      addressLines: ["123 Main St"],
20
      locality: "San Francisco",
21
      // ... other billing contact fields
22
    },
23
    // Pre-decrypted token from your own decryption
24
    decrypted: {
25
      applicationPrimaryAccountNumber: "4761120010000492",
26
      applicationExpirationDate: "271231",
27
      currencyCode: "840",
28
      transactionAmount: 1000,
29
      deviceManufacturerIdentifier: "050110030273",
30
      paymentDataType: "3DSecure",
31
      paymentData: {
32
        onlinePaymentCryptogram: "AOkAAAAI4IEBggABNkRpBg==",
33
        eciIndicator: "07"
34
      }
35
    }
36
  }
37
};

Error Handling

FAQ