{
  "merchantID": "702702000000000",
  "invoiceNo": "220920084480",
  "description": "V4 Test",
  "amount": "120",
  "currencyCode": "SGD",
  "paymentChannel": ["APPLEPAY"]
}

{
  "paymentToken": "kSAops9Zwhos8hSTSeLTUZhBH+ZITpUoBizPNDc+wcpzY5UL2WSG9ky0YSUNT8qJGNWjmT3oMAiGqa1banJ6MGkXkxDM41GKEAw/s0yiR05aTx1QTz7946Wewm7amkCx",
  "respCode": "0000",
  "respDesc": "Success"
}

<p>Buy with ApplePay</p>
<p>
  Compatible browsers will display an Apple&nbsp;Pay button below.
</p>
<div id="apple-pay-button" onclick="applePayButtonClicked()"></div>

<style>
  #apple-pay-button {
    -webkit-appearance: -apple-pay-button;
    -apple-pay-button-type: plain;
    -apple-pay-button-style: black;
    display: inline-block;
    width: 150px;
    height: 35px;
    vertical-align: middle;
    margin-left: 5px
  }
</style>

document.addEventListener("DOMContentLoaded", () => {
  if (window.ApplePaySession && ApplePaySession.canMakePayments()) {
    showApplePayButton();
  }
});

function showApplePayButton() {
  const buttons = document.getElementsByClassName("apple-pay-button");
  btn.classList.add("visible");
  btn.addEventListener("click", applePayButtonClicked);
}

function applePayButtonClicked() {
  const paymentRequest = {
    countryCode: "SG", // A2
    currencyCode: "SGD",
    lineItems: [
      {
        label: "item 1",
        amount: "99.0",
      },
    ],
    total: {
      label: "Total",
      amount: "99.0",
    },
    supportedNetworks: ["masterCard", "visa"],
    merchantCapabilities: ["supports3DS", "supportsCredit", "supportsDebit"],
  };

  const session = new ApplePaySession(3, paymentRequest);

  /**
   * Merchant Validation
   * Merchant will call to backend server to validate the merchant session
   */
  session.onvalidatemerchant = async (event) => {
    try {
      const resp = await fetch("/api/validate-merchant", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ validationURL: event.validationURL }),
      });
      if (!resp.ok) throw new Error("Network response not ok");
      const merchantSession = await resp.json();
      session.completeMerchantValidation(merchantSession);
    } catch (err) {
      console.error("Merchant validation failed", err);
      session.abort();
    }
  };

  /**
   * Payment Authorization
   * Here you receive the encrypted payment data. You would then send it
   * on to your payment provider for processing, and return an appropriate
   * status in session.completePayment()
   */
  session.onpaymentauthorized = async (event) => {
    // Send payment for processing...
    // The below example is used to send directly to 2C2P Endpoint
		// Merchant can choose to send to their backend server and then to 2C2P Endpoint
    const payment = event.payment;
    var requestData = JSON.stringify(payment.token.paymentData);
    var encodedString = Base64.encode(requestData);

    const data = {
      payment: {
        data: {
          token: encodedString, //Apple Pay Token
          name: "{CUSTOMER_NAME}",
          email: "{CUSTOMER_EMAIL}",
        },
        code: {
          channelCode: "APPLEPAY",
        },
      },
      paymentToken:
        "kSAops9Zwhos8hSTSeLTUVOcjgK4Cgv74lr26l90Ar0fr2OeHLgT0u1DHlBeYCZzghmE+UOooat4AGOoS+0ujukbBteCzwIansbend5nSAVieNGbLWn2UWb2NltoNiEW",
      clientID: "{{GUID}}",
    };

    try {
      const resp = await fetch(
        "https://sandbox-pgw-ui.2c2p.com/payment/4.3/doPayment",
        {
          method: "POST",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify(data),
        }
      );
      const result = await resp.json();
      if (result.success) {
        session.completePayment(ApplePaySession.STATUS_SUCCESS);
        window.location.href = "/order/confirmation";
      } else {
        session.completePayment(ApplePaySession.STATUS_FAILURE);
        alert("Payment failed: " + (result.error || "Unknown error"));
      }
    } catch (err) {
      console.error("Payment processing error", err);
      session.completePayment(ApplePaySession.STATUS_FAILURE);
    }
  };
  session.oncancel = (event) => {
    console.log("User cancelled Apple Pay session", event);
    // Optionally handle cancellation / fallback
  };

  // All our handlers are setup - start the Apple Pay payment
  session.begin();
}

// Sandbox
frame1.contentWindow.postMessage("{\"name\":\"parent_domain\",\"payload\":{\"domain\":\"{YOUR_PARENT_DOMAIN}\"}}","https://pgw-sandbox-ui.2c2p.com");

// Production
frame1.contentWindow.postMessage("{\"name\":\"parent_domain\",\"payload\":{\"domain\":\"{YOUR_PARENT_DOMAIN}\"}}","https://pgw-ui.2c2p.com");

[HttpPost]
public async Task<ActionResult> ValidateMerchant(AppleValidateMerchantSessionModel appleValidateMerchant)
{
    // TODO add additional mapping validation url from Apple Pay
    if (!Uri.TryCreate(appleValidateMerchant.ValidationUrl, UriKind.Absolute, out var requestUri))
    {
        return BadRequest(new ValidationResponse() { status = "ERROR", data = "Invalid validation url" });
    }

    try
    {
        var privateKey = new X509Certificate2(config.Value.PrivateKeyLocation, config.Value.PrivateKeyPassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable);

        var merchantIdentityCertificate = new AppleMerchantCertificate(privateKey);

        var payloadObj = new AppleMerchantSessionRequest()
        {
            DisplayName = "Awesome Idea Pte Ltd",
            Initiative = "web",
            InitiativeContext = Request.Host.Host,
            MerchantIdentifier = merchantIdentityCertificate.GetMerchantIdentifier()
        };
        string payload = JsonConvert.SerializeObject(payloadObj);

        string responsePayload;

        using (var handler = new HttpClientHandler())
        {
            handler.ClientCertificates.Add(merchantIdentityCertificate.GetCertificate());

            using (var client = new HttpClient(handler))
            {
                var response = await client.PostAsync(
                    requestUri,
                    new StringContent(payload, Encoding.UTF8, "application/json")
                );

                responsePayload = await response.Content.ReadAsStringAsync();

                if (response.IsSuccessStatusCode)
                {
                    // Pass-through Apple session JSON
                    return Content(responsePayload, "application/json");
                }
                else
                {
                    _logger.LogError(
                        "ValidateMerchant: httperror: {StatusCode}, response: {ResponsePayload}",
                        response.StatusCode, responsePayload
                    );

                    return BadRequest(new ValidationResponse
                    {
                        status = "ERROR",
                        data = $"Error: {responsePayload}"
                    });
                }
            }
        }
    }
    catch (Exception ex)
    {
        _logger.LogError(
            "ValidateMerchant: exception=> {Message}, {Exception}, IE: {InnerException}",
            ex.Message, ex, ex.InnerException
        );

        return BadRequest(new ValidationResponse { status = "ERROR", data = ex.Message });
    }
}

// app.js or routes/applePay.js
const express = require("express");
const axios = require("axios");
const https = require("https");
const fs = require("fs");

const router = express.Router();

// Load config from env or config file
const APPLE_MERCHANT_ID = process.env.APPLE_MERCHANT_ID; // e.g. merchant.com.your.app
const APPLE_MERCHANT_CERT_PATH = process.env.APPLE_MERCHANT_CERT_PATH; // path/to/merchant_id.p12
const APPLE_MERCHANT_CERT_PASSWORD = process.env.APPLE_MERCHANT_CERT_PASSWORD;

router.post("/api/validate-merchant", async (req, res) => {
  const { validationURL } = req.body;

  if (!validationURL) {
    return res
      .status(400)
      .json({ status: "ERROR", data: "Missing validationURL" });
  }

  // Basic URL validation
  try {
    new URL(validationURL);
  } catch {
    return res
      .status(400)
      .json({ status: "ERROR", data: "Invalid validationURL" });
  }

  try {
    // Build Apple Pay merchant validation payload
    const payload = {
      merchantIdentifier: APPLE_MERCHANT_ID,
      displayName: "Awesome Idea Pte Ltd",
      initiative: "web",
      // Must match the domain registered with Apple
      initiativeContext: req.headers.host,
    };

    const httpsAgent = new https.Agent({
      pfx: fs.readFileSync(APPLE_MERCHANT_CERT_PATH),
      passphrase: APPLE_MERCHANT_CERT_PASSWORD,
    });

    const response = await axios.post(validationURL, payload, {
      httpsAgent,
      headers: {
        "Content-Type": "application/json",
      },
    });

    // Pass Apple’s JSON directly back to frontend
    return res.json(response.data);
  } catch (err) {
    console.error("ValidateMerchant error:", err.response?.data || err.message);
    const errorBody =
      err.response?.data ||
      err.message ||
      "Unknown error calling Apple merchant validation";

    return res.status(500).json({
      status: "ERROR",
      data: errorBody,
    });
  }
});

module.exports = router;

<?php
// validate-merchant.php

// Config – ideally load from env or config file
define('APPLE_MERCHANT_ID', 'merchant.com.your.app');
define('APPLE_MERCHANT_CERT_PATH', __DIR__ . '/certs/merchant_id.p12'); // path to your p12
define('APPLE_MERCHANT_CERT_PASSWORD', 'your_password_here');

// Read JSON body
$rawBody = file_get_contents('php://input');
$data = json_decode($rawBody, true);

$validationUrl = $data['validationURL'] ?? null;

header('Content-Type: application/json');

if (!$validationUrl) {
    http_response_code(400);
    echo json_encode([
        'status' => 'ERROR',
        'data'   => 'Missing validationURL',
    ]);
    exit;
}

// Basic URL validation
if (!filter_var($validationUrl, FILTER_VALIDATE_URL)) {
    http_response_code(400);
    echo json_encode([
        'status' => 'ERROR',
        'data'   => 'Invalid validationURL',
    ]);
    exit;
}

// Build payload for Apple
$payload = [
    'merchantIdentifier' => APPLE_MERCHANT_ID,
    'displayName'        => 'Awesome Idea Pte Ltd',
    'initiative'         => 'web',
    // Must match the domain you registered with Apple
    'initiativeContext'  => $_SERVER['HTTP_HOST'],
];

$jsonPayload = json_encode($payload);

$ch = curl_init($validationUrl);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $jsonPayload);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

// TLS client certificate
curl_setopt($ch, CURLOPT_SSLCERTTYPE, 'P12');
curl_setopt($ch, CURLOPT_SSLCERT, APPLE_MERCHANT_CERT_PATH);
curl_setopt($ch, CURLOPT_SSLCERTPASSWD, APPLE_MERCHANT_CERT_PASSWORD);

$result = curl_exec($ch);
$curlErrNo  = curl_errno($ch);
$curlErrMsg = curl_error($ch);
$httpCode   = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($curlErrNo) {
    http_response_code(500);
    echo json_encode([
        'status' => 'ERROR',
        'data'   => "cURL error: $curlErrMsg",
    ]);
    exit;
}

if ($httpCode >= 200 && $httpCode < 300) {
    // Pass through Apple’s JSON directly
    http_response_code(200);
    echo $result;
} else {
    http_response_code(500);
    echo json_encode([
        'status' => 'ERROR',
        'data'   => "Apple returned HTTP $httpCode: $result",
    ]);
}

// main.go
package main

import (
	"crypto/tls"
	"encoding/json"
	"io"
	"log"
	"net/http"
	"net/url"
	"os"
	"time"
)

type ValidateMerchantRequest struct {
	ValidationURL string `json:"validationURL"`
}

type ErrorResponse struct {
	Status string      `json:"status"`
	Data   interface{} `json:"data"`
}

type AppleMerchantSessionRequest struct {
	MerchantIdentifier string `json:"merchantIdentifier"`
	DisplayName        string `json:"displayName"`
	Initiative         string `json:"initiative"`
	InitiativeContext  string `json:"initiativeContext"`
}

func main() {
	http.HandleFunc("/api/validate-merchant", validateMerchantHandler)

	log.Println("Server listening on :3000")
	if err := http.ListenAndServe(":3000", nil); err != nil {
		log.Fatal(err)
	}
}

func validateMerchantHandler(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
		return
	}

	var body ValidateMerchantRequest
	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
		writeError(w, http.StatusBadRequest, "Invalid JSON body")
		return
	}

	if body.ValidationURL == "" {
		writeError(w, http.StatusBadRequest, "Missing validationURL")
		return
	}

	parsedURL, err := url.ParseRequestURI(body.ValidationURL)
	if err != nil {
		writeError(w, http.StatusBadRequest, "Invalid validationURL")
		return
	}

	merchantID := os.Getenv("APPLE_MERCHANT_ID") // e.g. "merchant.com.your.app"
	if merchantID == "" {
		writeError(w, http.StatusInternalServerError, "Merchant ID not configured")
		return
	}

	// Build payload for Apple
	payload := AppleMerchantSessionRequest{
		MerchantIdentifier: merchantID,
		DisplayName:        "Awesome Idea Pte Ltd",
		Initiative:         "web",
		// Must match domain registered in Apple merchant profile
		InitiativeContext: r.Host,
	}

	payloadBytes, err := json.Marshal(payload)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "Failed to serialize payload")
		return
	}

	// Load client certificate (PEM)
	certFile := os.Getenv("APPLE_MERCHANT_CERT_FILE") // path/to/cert.pem
	keyFile := os.Getenv("APPLE_MERCHANT_KEY_FILE")   // path/to/key.pem

	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "Failed to load client cert/key")
		log.Println("tls.LoadX509KeyPair error:", err)
		return
	}

	tlsConfig := &tls.Config{
		Certificates: []tls.Certificate{cert},
	}

	transport := &http.Transport{
		TLSClientConfig: tlsConfig,
	}

	client := &http.Client{
		Transport: transport,
		Timeout:   15 * time.Second,
	}

	req, err := http.NewRequest(http.MethodPost, parsedURL.String(), io.NopCloser(
		// use a Reader over payloadBytes
		http.NoBody,
	))
	// We can't pass NoBody if we have payload; replace above with:
	// bytes.NewReader(payloadBytes)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "Failed to create request")
		return
	}

	// Fix: actually use payloadBytes
	req.Body = io.NopCloser(io.NewSectionReader(
		io.NewSectionReader(io.NewBuffer(payloadBytes), 0, int64(len(payloadBytes))),
		0,
		int64(len(payloadBytes)),
	))

	req.Header.Set("Content-Type", "application/json")

	resp, err := client.Do(req)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "Error calling Apple merchant validation")
		log.Println("client.Do error:", err)
		return
	}
	defer resp.Body.Close()

	respBody, err := io.ReadAll(resp.Body)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "Failed to read Apple response")
		return
	}

	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
		log.Printf("Apple returned %d: %s\n", resp.StatusCode, string(respBody))
		writeError(w, http.StatusInternalServerError, "Apple returned error: "+string(respBody))
		return
	}

	// Pass through Apple’s JSON directly
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusOK)
	_, _ = w.Write(respBody)
}

func writeError(w http.ResponseWriter, statusCode int, msg string) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(statusCode)
	_ = json.NewEncoder(w).Encode(ErrorResponse{
		Status: "ERROR",
		Data:   msg,
	})
}

from flask import Flask, request, jsonify
import os
import requests
from urllib.parse import urlparse

app = Flask(__name__)

APPLE_MERCHANT_ID = os.getenv("APPLE_MERCHANT_ID")  # e.g. "merchant.com.your.app"
CERT_FILE = os.getenv("APPLE_MERCHANT_CERT_FILE")   # path/to/cert.pem or .crt
KEY_FILE = os.getenv("APPLE_MERCHANT_KEY_FILE")     # path/to/key.pem


@app.route("/api/validate-merchant", methods=["POST"])
def validate_merchant():
    data = request.get_json(silent=True) or {}
    validation_url = data.get("validationURL")

    if not validation_url:
        return jsonify({"status": "ERROR", "data": "Missing validationURL"}), 400

    # Basic URL validation
    try:
        parsed = urlparse(validation_url)
        if not (parsed.scheme and parsed.netloc):
            raise ValueError("Invalid URL")
    except Exception:
        return jsonify({"status": "ERROR", "data": "Invalid validationURL"}), 400

    if not APPLE_MERCHANT_ID:
        return jsonify({"status": "ERROR", "data": "Merchant ID not configured"}), 500

    # Domain must match the one configured in Apple developer portal
    initiative_context = request.host

    payload = {
        "merchantIdentifier": APPLE_MERCHANT_ID,
        "displayName": "Awesome Idea Pte Ltd",
        "initiative": "web",
        "initiativeContext": initiative_context,
    }

    try:
        # cert=(cert_file, key_file) -> TLS client auth
        resp = requests.post(
            validation_url,
            json=payload,
            cert=(CERT_FILE, KEY_FILE),
            headers={"Content-Type": "application/json"},
            timeout=15,
        )
    except requests.RequestException as e:
        app.logger.error(f"ValidateMerchant: exception: {e}")
        return jsonify({"status": "ERROR", "data": str(e)}), 500

    # Pass-through Apple response
    if 200 <= resp.status_code < 300:
        # Apple already returns JSON
        return app.response_class(
            resp.content,
            status=200,
            mimetype="application/json",
        )
    else:
        app.logger.error(
            "ValidateMerchant: Apple HTTP %s: %s",
            resp.status_code,
            resp.text,
        )
        return jsonify(
            {
                "status": "ERROR",
                "data": f"Apple returned HTTP {resp.status_code}: {resp.text}",
            }
        ), 500


if __name__ == "__main__":
    app.run(port=3000, debug=True)

{
  "payment": {
    "data": {
      "token": "eyJkYXRhIjoiZnpDZ2h4aUVBejU2NzcwS0QzakZHMHRXaXB6VHVqbEFjOTQ2SGhvWFBBVEdmVStwTXRJR3RJbFNOVk5YdjZOWWs5UXRiT0lFV09XQXBuaTVzUy9UWGZIcE5jQTUzT0c5bU9xRWtRcnlzKy...", //Apple Pay Token
      "name": " Terrance",
      "email": "[email protected]"
    },
    "code": {
      "channelCode": "APPLEPAY"
    }
  },
  "responseReturnUrl": "https://pgw-ui.2c2p.com/payment/4.3/#/info/",
  "clientIP": "116.88.44.153",
  "paymentToken": "kSAops9Zwhos8hSTSeLTUVOcjgK4Cgv74lr26l90Ar0fr2OeHLgT0u1DHlBeYCZzghmE+UOooat4AGOoS+0ujukbBteCzwIansbend5nSAVieNGbLWn2UWb2NltoNiEW",
  "clientID": "62b9061f-cd93-4ee8-89cc-a8ffd09e8a95",
}

{
	"invoiceNo": "280520075921",
	"channelCode": "APPLEPAY",
	"respCode": "2000",
	"respDesc": "Transaction is completed, please do payment inquiry request for full payment information."
}

{
  "merchantID": "702702000000000",
  "invoiceNo": "220920084480",
  "cardNo": "",
  "amount": 120.0,
  "userDefined1": "",
  "userDefined2": "",
  "userDefined3": "",
  "userDefined4": "",
  "userDefined5": "",
  "currencyCode": "SGD",
  "cardToken": "",
  "recurringUniqueID": "",
  "tranRef": "3257744",
  "referenceNo": "3135918",
  "approvalCode": "",
  "eci": "  ",
  "transactionDateTime": "20200922101226",
  "agentCode": "CITI",
  "channelCode": "VI",
  "issuerCountry": "",
  "installmentMerchantAbsorbRate": null,
  "respCode": "0000",
  "respDesc": "Transaction is successful."
}

{
	"invoiceNo": "220920084480",
	"channelCode": "APPLEPAY",
	"respCode": "2000",
	"respDesc": "Transaction is completed, please do payment inquiry request for full payment information."
}

{
  "merchantID": "702792000000000",
  "invoiceNo": "220920084480",
  "locale": "en"
}

{
  "merchantID": "702702000000000",
  "invoiceNo": "220920084480",
  "cardNo": "",
  "amount": 120.0,
  "userDefined1": "",
  "userDefined2": "",
  "userDefined3": "",
  "userDefined4": "",
  "userDefined5": "",
  "currencyCode": "SGD",
  "cardToken": "",
  "recurringUniqueID": "",
  "tranRef": "3257744",
  "referenceNo": "3135918",
  "approvalCode": "",
  "eci": "  ",
  "transactionDateTime": "20200922101226",
  "agentCode": "CITI",
  "channelCode": "VI",
  "issuerCountry": "",
  "installmentMerchantAbsorbRate": null,
  "respCode": "0000",
  "respDesc": "Transaction is successful."
}