Apple Pay Certificates

Create certificates

Generate the certificate signing requests (CSRs) Guardian needs for Apple Pay. Guardian creates both an EC payment processing CSR and an RSA merchant identity CSR and keeps the private keys inside its PCI boundary. Submit each csr_pem to Apple in the Apple Developer portal, then return the signed certificates with Upload an Apple Pay certificate.

Available only on self_managed instances. On Starfish-operated (sf_operated) instances certificates are managed by Starfish, and this endpoint returns 409 with the classifier APPLE_PAY_CERT_MANAGEMENT_UNAVAILABLE.

POST

api

wallet

apple-pay

certificates

Create certificates

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "payment_processing": {
    "id": "6e2d8b4f-1c7a-4d3e-9f5b-8a4c2e6d9b1f",
    "state": "pending",
    "csr_pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAwRTEL...\n-----END CERTIFICATE REQUEST-----",
    "registration_order": 1,
    "created_at": "2026-02-01T09:10:00Z"
  },
  "merchant_identity": {
    "id": "6e2d8b4f-1c7a-4d3e-9f5b-8a4c2e6d9b1f",
    "state": "pending",
    "csr_pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAwRTEL...\n-----END CERTIFICATE REQUEST-----",
    "registration_order": 1,
    "created_at": "2026-02-01T09:10:00Z"
  }
}

{
  "code": 400,
  "message": "The request could not be handle due to invalid data",
  "classifier": "BAD_REQUEST"
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

Authorizations

Authorization

string

header

required

JWT bearer token obtained via the OAuth2 client-credentials grant from the platform Authentication API. The token's scopes gate the endpoints it may call, and its audience names the Guardian instance. This is the standard way to authenticate to Guardian.

Response

Success response

Both Apple Pay CSRs to submit to Apple: the EC payment-processing certificate and the RSA merchant-identity certificate. The CSR flow is self_managed-only; on Starfish-operated (sf_operated) instances the same RSA certificate is surfaced as a platform integrator identity and is managed by Starfish.

payment_processing

Apple Pay Certificate Signing Request · object

required

Show child attributes

merchant_identity

Apple Pay Certificate Signing Request · object

required

Show child attributes

⌘I

Create certificates

curl --request POST \
  --url https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{instance}.{env}.on-hellgate.cloud/api/wallet/apple-pay/certificates")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "payment_processing": {
    "id": "6e2d8b4f-1c7a-4d3e-9f5b-8a4c2e6d9b1f",
    "state": "pending",
    "csr_pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAwRTEL...\n-----END CERTIFICATE REQUEST-----",
    "registration_order": 1,
    "created_at": "2026-02-01T09:10:00Z"
  },
  "merchant_identity": {
    "id": "6e2d8b4f-1c7a-4d3e-9f5b-8a4c2e6d9b1f",
    "state": "pending",
    "csr_pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIICijCCAXICAQAwRTEL...\n-----END CERTIFICATE REQUEST-----",
    "registration_order": 1,
    "created_at": "2026-02-01T09:10:00Z"
  }
}

{
  "code": 400,
  "message": "The request could not be handle due to invalid data",
  "classifier": "BAD_REQUEST"
}

{
  "code": 401,
  "message": "No valid means of authentication was provided",
  "classifier": "UNAUTHORIZED"
}

{
  "code": 403,
  "message": "Not allowed to access this resource or feature",
  "classifier": "FORBIDDEN"
}

{
  "code": 409,
  "message": "Conflict",
  "classifier": "CONFLICT"
}

Getting Started

Tokens

Metadata

Admin

Create certificates

Authorizations

Response