> For the complete documentation index, see [llms.txt](https://docs.thewalletcrew.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thewalletcrew.io/configure/advanced-configuration/wallet/apple-and-google-wallet/apple-wallet-certificates.md).
# Apple Wallet certificates
Configure the Apple Developer account, certificates, and APNs push credentials that let The Wallet Crew issue Apple Wallet passes for a brand.
To issue Apple Wallet passes that display the brand's own identity and receive real-time updates, certificates and push notification credentials must be established through the Apple Developer Program.
The credentials stay with the brand: Apple issues them to the brand, which delegates pass issuance to The Wallet Crew.
Want the “why” before the “how”? Start with [Apple & Google wallet](/configure/advanced-configuration/wallet/apple-and-google-wallet.md).
## Before you begin
### What this guide covers
* Create a Pass Type ID that identifies the organization as the pass issuer
* Generate and configure certificates that sign the wallet passes
* Set up Apple Push Notification service (APNs) for real-time pass updates
* Connect the Apple Developer account credentials to The Wallet Crew platform
### Prerequisites
* Active Apple Developer Program membership ($99/year for organizations)
* Administrator access to the Apple Developer account
* Authority to create certificates and authentication keys
* Access to The Wallet Crew admin console
### Apple Developer Program enrollment requirements
Before beginning this configuration, ensure the organization has enrolled in the Apple Developer Program as an **Organization** (not as an individual). This enrollment requires:
* **D-U-N-S Number** from Dun & Bradstreet for business verification. Apple usually sends it by email with the subject `Your D-U-N-S Number is enclosed.` from `Apple Developer `
* **Work email address** linked to the company's domain (avoid personal Gmail/Yahoo accounts)
* **Publicly accessible website** reflecting the company's legal identity
* **Legal binding authority** as an owner, executive, or authorized employee to sign Apple's agreements
If enrollment has not happened yet, visit the Apple Developer Program enrollment page to begin the process. Enrollment as an organization (rather than individual) ensures the company name appears on wallet passes and enables multi-user account management.
## Kickoff
### Choose a setup path
* **Option 1 — Account delegation:** Grant The Wallet Crew administrator access to configure the integration. This is the fastest option.
* **Option 2 — Self-configuration:** Manage the complete setup within the organization. This maintains strict access control and requires familiarity with Apple Developer.
Both options provide the same functionality. Account delegation reduces the implementation workload. Self-configuration retains complete internal control.
### Option 1 — account delegation
This approach allows The Wallet Crew team to handle all technical configuration while the brand retains ownership of its Apple Developer account. Temporary administrator access is granted, and we configure certificates, keys, and identifiers according to Apple's best practices.
#### Grant Administrator Access
Navigate to App Store Connect Users and sign in with the Apple Developer account credentials.
Click the **Add (+)** button to invite a new user. Enter `contact@neostore.cloud` as the email address and assign the **Admin** role. This permission level allows The Wallet Crew team to create Pass Type IDs, generate certificates, configure push notification keys, and complete all necessary setup steps.
App Store Connect users page showing how to invite a new admin user
The Wallet Crew team will receive an invitation notification and will proceed with Pass Type ID creation, certificate generation, and APNs configuration. We notify the brand when setup is complete and provide documentation of all created resources. This administrator access can be revoked after confirming that wallet pass issuance and updates are working correctly.
**What happens next:** After access is granted, we create the Pass Type ID (formatted as `pass.com.thewalletcrew.{tenantId}`), generate the signing certificate, configure push notifications, and upload everything to the tenant. This typically completes within 1–3 business days. We’ll confirm by email and share a short summary of what was created.
### Option 2 — configuration on your own
The complete setup is managed within the brand's Apple Developer account and The Wallet Crew admin console. This option requires familiarity with Apple's certificate infrastructure but maintains strict internal access control.
#### Understanding the Components
Before proceeding, it's helpful to understand what is being created:
The **Pass Type ID** is the issuer identifier (for example `pass.com.thewalletcrew.{tenantId}`). The **CSR** is a request file generated in The Wallet Crew that Apple uses to create the certificate. The **signing certificate** is what cryptographically signs each pass. The **APNs auth key** is what lets us trigger updates for passes already installed on devices.
Follow these steps to configure the Apple membership program for The Wallet Crew.
{% stepper %}
{% step %}
**Login and open Identifiers**
1. Login to the Apple developer program console:
2. Go to Certificates, IDs & Profiles > Identifiers
{% endstep %}
{% step %}
**Create a Pass Type ID**
1. Click the + button and select Pass Type IDs, then click Continue.
2. Fill the form. Set the description to `membership pass`. Set the identifier to the value shown in The Wallet Crew under `pass type identifier`.
The value should follow the pattern `pass.com.thewalletcrew.{tenantId}` where `{tenantId}` is the brand identifier.
{% hint style="danger" %}
Treat the Pass Type ID identifier as permanent. Once passes have been issued, changing it typically breaks updates and can force a full re-issuance.
{% endhint %}
Copy this exact value and paste it into the Apple Developer Portal identifier field.
The Wallet Crew console showing the Pass Type Identifier value to copy into Apple Developer Portal
{% hint style="warning" %}
If this identifier must be modified for any reason, click the lock icon next to the field in The Wallet Crew console and coordinate the change with the point of contact at The Wallet Crew to ensure proper synchronization. Never do it without the consent of that point of contact.
{% endhint %}
Click **Continue** to review the settings, then click **Register** to create the Pass Type ID.
{% endstep %}
{% step %}
**Navigate to Pass Type ID Details**
After registering the Pass Type ID, Apple returns to the identifiers list. Locate and click on the Pass Type ID just created to open its detail page.
Apple Developer Portal identifiers list showing the created Pass Type ID
In the Pass Type ID details page, click the **Create Certificate** button. This will open Apple's certificate creation workflow
Leave this browser tab open and switch to The Wallet Crew admin console tab. If it is not open, navigate to The Wallet Crew Apple Configuration.
{% endstep %}
{% step %}
**Generate Certificate Signing Request (CSR)**
In The Wallet Crew console, locate the **Certificate Signing Request (CSR)** section and click **Generate CSR**. The system will create a cryptographic signing request file. Once generation completes, click **Download CSR** to save the file locally. The filename will be similar to `pass.cloud.thewalletcrew.{yourbrand}.csr`.
The Wallet Crew Apple configuration showing the Generate CSR action
The Wallet Crew Apple configuration showing the Download CSR action
{% endstep %}
{% step %}
**Upload CSR to Apple and download certificate**
Return to the Apple Developer Portal browser tab where the certificate creation form is waiting. Leave the **Certificate name** field empty so Apple auto-generates it, then upload the `.csr` file downloaded from The Wallet Crew.
Click **Continue** to process the CSR. Apple will generate the signing certificate using the cryptographic information from The Wallet Crew's CSR.
Apple Developer Portal certificate creation form showing CSR upload
Apple Developer Portal certificate download screen for the generated pass certificate
On the confirmation page, click **Download** to save the certificate file (named `pass.cer`) locally. This certificate file is the cryptographic credential that will sign all wallet passes issued by the organization.
{% endstep %}
{% step %}
**Upload certificate to The Wallet Crew**
Navigate back to The Wallet Crew Apple Configuration page. Locate the **Certificate Upload** section.
Click **Choose File** and select the `pass.cer` certificate file downloaded from Apple. The Wallet Crew system will validate that the certificate matches the CSR and is properly configured.
Review the certificate information displayed (expiration date, issuer details) and click **Apply Certificate** to complete the upload. The certificate is now active and will be used to sign all wallet passes created.
The Wallet Crew Apple configuration showing certificate upload and Apply Certificate
{% endstep %}
{% step %}
**Create APNs Auth Key in Apple**
Apple Push Notification service (APNs) enables real-time updates to wallet passes after they've been installed on customers' devices. When a pass balance, event details, or any other pass content is updated, APNs notifies the customer's device to download the latest version.
Navigate to the Apple Developer Keys page and click the **+ button** to create a new key.
Complete the key registration form: Name the key (for example “Wallet Push Notifications”), enable **Apple Push Notifications service (APNs)**, then click **Configure** next to APNs to pick the environment.
In the APNs configuration dialog, select **Production** environment (not Sandbox). Production environment is required for wallet passes to receive updates in real-world usage. Click **Save** to confirm this setting.
Apple Developer Portal key registration form with APNs enabled
Click **Continue** to review the key configuration, then click **Register** to create the key. Apple will display the Key ID, a critical piece of information needed in the next step, so copy it to a safe location.
Click **Download** to save the authentication key file (named `AuthKey_XXXXXXXXXX.p8`).
**Important:** Apple only allows this file to be downloaded once. If it is lost, the key must be revoked and a new one created. Store the downloaded `.p8` file securely—treat it like a password.
{% endstep %}
{% step %}
**Upload APNs key to The Wallet Crew**
Navigate to The Wallet Crew APNs Configuration page.
Complete the APNs configuration form: Paste the **Key ID** copied from Apple (10 characters) and upload the `AuthKey_XXXXXXXXXX.p8` file downloaded from Apple.
Click **Save** or **Apply** to upload the APNs credentials. The Wallet Crew platform will validate the key and configure push notifications for the tenant.
The Wallet Crew APNs configuration showing Key ID and .p8 file upload
**Configuration complete:** The Apple Wallet integration is now fully configured. Wallet passes can be created, and they will be signed with the certificate and capable of receiving real-time updates via APNs.
{% endstep %}
{% endstepper %}
## Certificate Renewal
Apple Wallet certificates expire annually and must be renewed to continue issuing passes. Apple will send reminder emails before expiration, but certificates should be renewed proactively at least two weeks before the expiration date to avoid service interruption.
{% hint style="info" %}
**Timeline:** Certificate renewal takes approximately 15 minutes. Existing passes continue working during renewal, with no downtime.
{% endhint %}
{% hint style="warning" %}
### Renewal does not affect production
Renewing a certificate in staging does not update production. Upload the renewed certificate separately in the production tenant.
{% endhint %}
{% stepper %}
{% step %}
**Initiate Certificate Renewal in Apple**
Navigate to the Apple Developer Account and sign in. Select **Certificates, IDs & Profiles** from the left navigation, then click **Certificates**.
Click the **+ button** to create a new certificate. Select **Pass Type ID Certificate** from the list of certificate types, then click **Continue**.
{% endstep %}
{% step %}
**Generate CSR in The Wallet Crew**
1. Open The Wallet Crew admin console and click **Generate CSR**. Even if a previous CSR file exists, a new one must be generated for renewal.
2. Click **Generate CSR** to create a new certificate signing request. Once generation completes, click **Download CSR** to save the file. The filename will be similar to `pass.cloud.thewalletcrew.{yourbrand}.csr`.
The Wallet Crew Apple configuration showing Generate CSR for renewal
The Wallet Crew Apple configuration showing Download CSR for renewal
{% endstep %}
{% step %}
**Upload CSR to Apple and download renewed certificate**
Return to the Apple Developer Portal. In the certificate creation workflow, upload the new CSR file just downloaded from The Wallet Crew.
Click **Continue** to generate the renewed certificate, then click **Download** to save the new `pass.cer` file.
Apple Developer Portal download screen for the renewed pass certificate
{% endstep %}
{% step %}
**Upload renewed certificate to The Wallet Crew**
Navigate to The Wallet Crew Apple Configuration page. Upload the renewed `pass.cer` certificate file.
Review the new expiration date to confirm it's been extended for another year, then click **Apply Certificate**.
**Renewal complete:** The certificate is renewed for another year. All existing passes continue working seamlessly, and new passes will be signed with the renewed certificate.
The Wallet Crew Apple configuration showing upload of the renewed certificate and Apply Certificate
{% endstep %}
{% endstepper %}
## Troubleshoot certificate renewal
### Multiple certificates in Apple Developer
Two certificates for the same Pass Type ID are expected during renewal. The existing certificate remains active while Apple adds the renewed certificate.
The Wallet Crew automatically uses the newest active certificate. The older certificate expires naturally and does not require revocation.
Do not revoke the older certificate while it remains valid. Revocation can briefly interrupt pass issuance before the renewed certificate propagates.
After the older certificate expires, it can be deleted in Apple Developer. Deleting it does not affect The Wallet Crew platform.
### CSR upload shows an older file
During renewal, the CSR upload screen in the admin console may show a dropdown of earlier files. This happens when the browser session caches previously selected files.
Select **Upload new file** or **Browse** beside the dropdown. The link can appear visually de-emphasized but still accepts a new CSR file.
If the link is unavailable, open the page in a private or incognito window. This starts a fresh browser session. If the issue continues, contact The Wallet Crew support with a screenshot. The team can upload the renewed certificate directly to the tenant.
## FAQ
What is a Pass Type ID and why do I need one?
A Pass Type ID is the issuer identifier in Apple’s ecosystem (for example `pass.com.thewalletcrew.{tenantId}`). It tells Apple and iOS devices which organization is allowed to issue and sign passes, which is why it’s required for any Apple Wallet deployment. Most brands use one Pass Type ID across all their pass types.
What's the difference between a CSR, certificate, and APNs key?
The CSR is a request file generated in The Wallet Crew and uploaded to Apple. Apple uses it to generate the signing certificate, which is the credential used to sign every pass. The APNs key is separate. It’s what lets The Wallet Crew authenticate to Apple Push Notification service to trigger updates for passes already installed on devices.
Why do I need a certificate (.cer) and an APNs key (.p8)?
Apple Wallet splits “trust” into two pieces. The `.cer` certificate signs the passes, so devices can verify the pass is authentic and hasn’t been tampered with. The `.p8` APNs key authenticates the push channel, so Apple accepts update notifications for those passes and devices know they should refresh.
How long does Apple Developer Program enrollment take?
For organizations, Apple typically approves enrollment in 2–5 business days. Sometimes Apple asks for extra verification around the D‑U‑N‑S number or company identity. The D‑U‑N‑S number is usually sent by email with the subject `Your D-U-N-S Number is enclosed.` from `Apple Developer `. Once approved, the wallet certificate setup usually takes around 1–2 hours.
Can I use an individual Apple Developer account instead of organization?
It is technically possible, but rarely a good idea. Individual accounts show a personal name on passes and don’t support the same team workflows. Most businesses should enroll as an organization (same $99/year price).
What happens if my certificate expires?
If the certificate expires, issuing and updating passes can fail. Passes already installed may still display, but they won’t reliably receive updates. Renew at least two weeks before expiration; Apple usually sends reminders about 30 days before.
Do I need to renew the APNs authentication key?
No. APNs keys do not expire, so they are not renewed. Only the Pass Type ID certificate is normally renewed each year. If the APNs key is revoked in Apple’s portal, a new one must be created and uploaded to The Wallet Crew.
Can I revoke delegated access after initial setup?
Yes. Once everything is configured, the delegated admin user can be removed from App Store Connect and the integration will keep working. Delegation is only needed for initial setup, and it’s optional for renewals.
What if I can't find my Pass Type Identifier in The Wallet Crew console?
It is on the Apple Configuration page under **Pass Type Identifier**. If it’s empty or errors, contact the point of contact at The Wallet Crew. The tenant may need a small setup step before Apple configuration is available.
Why must I use "production" APNs environment, not "sandbox"?
Apple Wallet uses the production APNs environment, even for testing. Sandbox is meant for iOS app development, not passes. If sandbox is configured by mistake, push updates won’t work reliably.
How do I know if my configuration is working correctly?
Create a test pass in The Wallet Crew and add it to an iPhone. If it installs and shows the organization name, signing works. Then change a simple field (like a balance or text) and confirm the installed pass refreshes within a few seconds.
What should I do with the .p8 APNs key file after uploading?
Store the `.p8` file like a password, ideally in a password manager or secure document storage. It may be needed later for audits, reconfiguration, or if Apple asks for verification of the APNs setup. Don’t commit it to version control and don’t send it over unencrypted email.
Can I use the same Apple Developer account for multiple brands?
Yes, but each brand should use its own Pass Type ID. One Apple Developer account can host multiple Pass Type IDs, each with its own certificate. In The Wallet Crew, each tenant maps to its own Apple configuration.
We already have existing passes. How do we migrate to The Wallet Crew?
This is a **migration** of live passes, not a normal “renewal”.
For Apple, the key constraint is issuer identity. In practice, keep the **same Pass Type ID**, export the existing pass technical data (like serial number + auth token), then repoint updates to The Wallet Crew.
Follow the dedicated guide: [Move passes to The Wallet Crew](/configure/advanced-configuration/wallet/import-and-export/pass-migration/move-passes-to-the-wallet-crew.md).
When leaving The Wallet Crew, use: [Export passes from The Wallet Crew to another provider](/configure/advanced-configuration/wallet/import-and-export/pass-migration/export-passes-from-twc-to-another-provider.md).
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.thewalletcrew.io/configure/advanced-configuration/wallet/apple-and-google-wallet/apple-wallet-certificates.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
