Apple Pay Setup Guide for Cybersource

This guide walks through the complete setup process for integrating Apple Pay with Cybersource in the Recurrente application.

Prerequisites

Apple Developer Program membership ($99/year)
Access to Cybersource Business Center
macOS computer (for certificate generation)

Part 1: Apple Developer Account Setup

1.1 Create a Merchant ID

Go to Certificates, Identifiers & Profiles
Click Identifiers in the sidebar
Click the + button to add a new identifier
Select Merchant IDs and click Continue
Enter a description (e.g., "Recurrente Production")
Enter an identifier (e.g., merchant.com.recurrente.production)
Click Continue then Register

Part 2: Payment Processing Certificate (for Cybersource)

This certificate encrypts payment data. Cybersource will decrypt it.

2.1 Generate CSR in Cybersource Business Center

Log into Cybersource Business Center
Go to Payment Configuration → Digital Payment Solutions
Select Apple Pay
Click Generate CSR (Certificate Signing Request)
Download the .csr file

2.2 Create Certificate in Apple Developer Portal

Go to Certificates, Identifiers & Profiles
Click Identifiers → Select Merchant IDs
Select your merchant identifier
Under Apple Pay Payment Processing Certificate, click Create Certificate
Select No when asked "Will payments be processed exclusively in China?"
Click Continue
Upload the CSR file you downloaded from Cybersource
Click Continue then Download the .cer file

2.3 Upload Certificate to Cybersource

Back in Cybersource Business Center
Go to Payment Configuration → Digital Payment Solutions → Apple Pay
Upload the .cer file you just downloaded from Apple
Save the configuration

Part 3: Merchant Identity Certificate (for Web)

This certificate authenticates your server when validating the merchant session with Apple.

3.1 Create a Certificate Signing Request (CSR) on your Mac

Open Keychain Access (Applications → Utilities)
Go to Keychain Access → Certificate Assistant → Request a Certificate From a Certificate Authority
Enter your email address
Enter a common name (e.g., "Recurrente Apple Pay")
Select Saved to disk
Click Continue and save the .certSigningRequest file

3.2 Create the Merchant Identity Certificate

Go to Certificates, Identifiers & Profiles
Click Identifiers → Select Merchant IDs
Select your merchant identifier
Under Apple Pay Merchant Identity Certificate, click Create Certificate
Click Continue
Upload the .certSigningRequest file you created
Click Continue then Download the .cer file

3.3 Export as .p12 (for your Rails app)

Double-click the downloaded .cer file to install it in Keychain
Open Keychain Access
Find the certificate (under "My Certificates")
Right-click and select Export
Choose Personal Information Exchange (.p12) format
Set a password (you'll need this for Rails credentials)
Save the file

3.4 Convert to PEM format and Base64 encode

Extract the certificate and private key
Base64 encode both files

# Extract the certificate
openssl pkcs12 -in merchant_identity.p12 -clcerts -nokeys -out merchant_identity_cert.pem

# Extract the private key
openssl pkcs12 -in merchant_identity.p12 -nocerts -out merchant_identity_key.pem

# Base64 encode for Rails credentials
base64 -i merchant_identity_cert.pem -o merchant_identity_cert.b64
base64 -i merchant_identity_key.pem -o merchant_identity_key.b64

Part 4: Domain Verification

4.1 Register Your Domain

Go to Certificates, Identifiers & Profiles
Click Identifiers → Select Merchant IDs
Select your merchant identifier
Under Merchant Domains, click Add Domain
Enter your domain (e.g., checkout.recurrente.com)
Click Save
Click Download to get the verification file

4.2 Host the Verification File

Place the downloaded file at the required path

https://yourdomain.com/.well-known/apple-developer-merchantid-domain-association

Option A: Place the file directly in public/.well-known/

mkdir -p public/.well-known
cp ~/Downloads/apple-developer-merchantid-domain-association public/.well-known/

Option B: Add a route in Rails (if you need dynamic handling)

# config/routes.rb
get ".well-known/apple-developer-merchantid-domain-association",
    to: proc { [200, {}, [File.read(Rails.root.join("public/.well-known/apple-developer-merchantid-domain-association"))]] }

4.3 Verify the Domain

Back in Apple Developer Portal
Click Verify next to your domain
Apple will crawl your site to confirm the file exists

Note: You must verify each domain separately (e.g., recurrente.com, checkout.recurrente.com, staging.recurrente.com)

Part 5: Configure Rails Credentials

Edit your credentials file:

EDITOR="code --wait" bin/rails credentials:edit --environment production

Add the following configuration:

apple_pay:
  merchant_identifier: "merchant.com.recurrente.production"
  display_name: "Recurrente"
  merchant_identity_cert_b64: "<paste contents of merchant_identity_cert.b64>"
  merchant_identity_key_b64: "<paste contents of merchant_identity_key.b64>"
  merchant_identity_key_passphrase: "<your .p12 password>"

For staging/test environments, create separate merchant IDs and certificates:

EDITOR="code --wait" bin/rails credentials:edit --environment staging

Part 6: Cybersource Configuration

Ensure the following are configured in Cybersource Business Center:

Apple Pay enabled for your merchant account
Payment Processing Certificate uploaded (from Part 2)
Merchant ID matches what you're using in Rails credentials

Part 7: Testing

Requirements

Safari browser on macOS or iOS (Apple Pay only works in Safari)
Apple device with a card added to Apple Wallet
For sandbox: Use Apple's test cards

Sandbox Testing

Create a sandbox tester account in App Store Connect
Sign into iCloud with sandbox account on test device
Add test cards to Apple Wallet
Test on your staging environment

Test Card Numbers

Apple provides test cards for sandbox environments. See Apple Pay Sandbox Testing for the full list.

bronzdoc/APPLE_PAY_SETUP.md

Select an option

No results found