Hello, We’re developing a loyalty program using Apple Wallet passes, and everything works except the silent push update flow. Context PassTypeIdentifier: pass.order.com.lealtad.xxxx Device is physical (not simulator) Pass is installed and visible in Wallet Correct pushToken is stored in our backend Push response from APNs: StatusCode: 200 OK apns-id: DBFF9693-D053-AA20-D737-3B24414105F3 WebServiceURL is reachable: https://xxxxx.net GET /passes/{passTypeIdentifier}/{serialNumber} endpoint is implemented and logs all calls No call is received from Apple to GET /passes/... after the push .pkpass is signed and installs correctly push payload json Copiar Editar { "aps": { "content-available": 1 }, "serialNumbers": ["9a4c9376d4"], "updated": true } pass.json json Copiar Editar { "formatVersion": 1, "passTypeIdentifier": "pass.order.com.lealtad.xxxxx", "teamIdentifier": "xxxxxxxx", "serialNumber": "9a4c9376d4xxxxxx", "webServiceURL": "https://xxxxxx.net", "authenticationToken": "xxxxxxxxxxxxxxxxx", ... } We have verified: Pass is installed and contains the correct authentication token. Pass registration via POST /devices/... happens and is logged. Push notifications are sent successfully and received (APNs 200 OK). Our endpoint GET /passes/... responds properly with Authorization: Bearer {{token}}. Certificate used to send the push is the same type as the one used to sign the .pkpass. What could cause Apple Wallet to ignore the push? We would appreciate guidance on what might be preventing Wallet from calling the webServiceURL after a valid push. Is there a way to trace why Apple is not triggering the request? Thanks in advance for your help. Best regards, José Ruiz

When downloading a .zip file with a pass package, when trying to open a file it only appears as a file but is not added to the wallt.

My application is from a bank that provides payment passes, and when I try to retrieve passes already enrolled in the wallet, it always returns empty. Is there something I need to configure for it to work? This is what I've tried, and it hasn't worked: let pkPassLibrary = PKPassLibrary() let paymentPasses = pkPassLibrary.passes(of:.payment) let pkPassLibrary = PKPassLibrary() let paymentPasses: [PKSecureElementPass]=pkPassLibrary .passes(of: .secureElement) .compactMap { $0 as? PKSecureElementPass }

I'm creating an event ticket Apple Wallet Pass and setting a light-coloured background image. When I do this, it automatically sets the foregroundColor to white, even when I explicitly set it to black. What's strange is that on my Mac, the foregroundColor appears as intended, and I can set it to any color I want, but when I AirDrop the pass to my iPhone, it sets the color to white, regardless of what I set the foregroundColor to. This means the text becomes completely illegible for my users, with white text on a white background image. If I remove the background image, the foregroundColor works fine. Is there a way to have a light-colored background image with dark text, or am I forced to have a dark-colored background image? Here are the colors in my pass.json: backgroundColor: "rgb(255, 255, 255)" foregroundColor: "rgb(0, 0, 0)" labelColor: "rgb(0, 0, 0)" I've attached what the pass looks like on my Mac and my iPhone.

My application is from a bank that provides payment passes, and when I try to retrieve passes already enrolled in the wallet, it always returns empty. Is there something I need to configure for it to work? This is what I've tried, and it hasn't worked

I want to be able to retrieve payment form wallet, I've used the PKPassLibrary but it hasn't worked

Hi, We are distributing pk pass files via a web browser. When a user taps Add in the system pass preview, the pass is added successfully, the preview is dismissed, and the user remains in the browser. From a user experience perspective, we would like to better guide users to their newly added pass in Apple Wallet. Is there a supported API, URL scheme, or documented mechanism that allows a web-based flow to transition the user to the Wallet app after a pass has been added? If direct app transitions are not supported in this scenario, what is the recommended best practice for helping users locate and open their newly added pass in Wallet? Thank you for your guidance.

Hello there, We’re currently integrating Apple Wallet pass functionality into our application and am looking for clarification around the automatic update flow. Particularly regarding secure management of the authenticationToken. We’ve reviewed the documentation here: Adding a Web Service to Update Passes authenticationToken Documentation From our understanding: When a user downloads a pass from our service, the .pkpass includes both a webServiceURL and an authenticationToken. Once the pass is added to Wallet, the Wallet app makes authenticated requests to our webServiceURL, using the token in the Authorization header. We then validate this token server-side to serve updates or handle device registration. So far, this flow is clear. However, we’re looking for clarification on two key scenarios: If a user adds the same pass twice on the same device, should the authenticationToken remain the same in both cases? If the same user adds the same pass on a different device, should the authenticationToken also remain consistent across devices? If the answer to both is “yes,” we assume that our backend must store the original authenticationToken in a retrievable form (not just as a hash) to regenerate the same pass for re-download or multi-device sync. Our main question is: What is Apple’s recommended or acceptable approach to storing authenticationToken values securely on the backend? Should these tokens be: Stored in plaintext (e.g. in a protected DB field)? Encrypted using a symmetric key? Hashed (not reversible, but limits reuse)? We want to ensure we align with Apple’s best practices for Wallet security and token management, especially in contexts where the same pass may be installed on multiple devices or reissued later.

Hi everyone, With the rapid growth of digital banking, payments, and AI-driven financial services, building secure and scalable FinTech apps on iOS has become more complex than ever. From handling sensitive user data to ensuring compliance and seamless performance, iOS developers face multiple technical challenges. Key areas that usually require deep expertise include: Apple Pay and Wallet integrations Secure authentication (Face ID / Touch ID / biometrics) Real-time transaction processing Core ML for financial predictions SwiftUI dashboards for financial analytics Data encryption and regulatory compliance https://www.nimbleappgenie.com At Nimble AppGenie, we’ve worked extensively as a FinTech app development expert, helping startups and enterprises design and build iOS financial applications that are secure, scalable, and user-centric. Our experience shows that the most successful fintech apps are those that balance strong security architecture with intuitive UX and performance optimization. I’m interested to hear from the community: What are the biggest challenges you’ve faced while building fintech apps on iOS? Are there any recent iOS updates or Apple frameworks that significantly improved your fintech workflows? How are you handling compliance and security in production apps? Looking forward to learning from everyone’s experiences and best practices.

Hello, I'm implementing the wallet extension for a financial app. Right now I'm having a problem, I want to redirect to the main app when the user hasn't logged in. Is it possible? This is my code in the WalletUI. It just doesn't work. let urlString = "bank://login" guard let url = URL(string: urlString) else { return } self.extensionContext?.open(url, completionHandler: { success in if !success { print("Success") } else { self.completionHandler?(.canceled) } }) }

We have tried using multiple test devices to dev and test Digital Wallet provisioning and unable to do it successfully as the rule decision goes into orange flow. This is a blocker for our project involving digial wallet provisioning testing. Is there a way that our test devices could be excluded from hitting orange rule so we can continue with provisioning?

We are getting vulnerabilities for passkit generator, used for apple wallet creation. Could you please suggest how to resolve this issue In our system we updated MIME with latest version but passkit is referring older version 1.4.1 npm audit report mime <1.4.1 Severity: high mime Regular Expression Denial of Service when MIME lookup performed on untrusted user input - https://github.com/advisories/GHSA-wrvr-8mpx-r7pp No fix available node_modules/mime passkit * Depends on vulnerable versions of mime node_modules/passkit 2 high severity vulnerabilities Some issues need review, and may require choosing a different dependency.

As a company, we would like to implement digital passes in the Apple Wallet. We're wondering which option we should follow to be able to do so. Our company creates and manages access control devices to put on waste drop-off points. Our goal is to give the opportunity to our final users to unlock these drop-off points with their iphone. A contact told us to use the NFC & SE but this solution seems not to be available in France and not directly integrated with the Apple Wallet. We've seen Apple Wallet Access and Apple Wallet VAS as alternatives but we're not sure any of these two are really matching our usecase. We definitely want our passes to be directly integrated within the wallet, without an app.

Good day) Colleagues, please tell me how can I change the notification on the locked screen "pass changed" in PKPASS when changing several fields? Thank you very much for your answer