Server-Side Wallet Pass Generation and Updates
A client updates a loyalty card — the user sees old points. Push notifications arrive, but Wallet does not update. Typical mistake: incorrect manifest.json signature or missing valid authenticationToken. We solve this by embedding server-side pkpass generation from scratch. This approach saves up to 60% of maintenance time and eliminates private key leakage. Cost savings: up to $3,000 in initial development and $500 per year in maintenance.
Server-side generation is the only secure method: the Pass Type ID private key is stored exclusively on the backend; the client receives a fully signed file. Our Python implementation using PassKit documentation passes Apple Wallet validation in 100% of cases. According to the documentation, a correct signature is mandatory for adding a pass.
How Server-Side pkpass Generation Works
The foundation is a signed ZIP archive. The server assembles pass.json (typically 2–5 KB), images (icon 29×29 px, logo up to 160×50 px), manifest.json (under 1 KB), and signature (a PKCS#7 detached signature, ~2 KB). The signing uses the Pass Type ID certificate and the intermediate Apple WWDRCA. The entire process takes less than 0.5 seconds — 10 times faster than on a mobile device.
| Component | Purpose | Size / Format |
|---|---|---|
| pass.json | JSON pass description (fields, colors, barcode) | 2–5 KB |
| icon.png / icon@2x / icon@3x | App icon | 29×29 / 58×58 / 87×87 pt, PNG |
| logo.png | Company logo | up to 160×50 pt, PNG |
| manifest.json | SHA1 hashes of all files | ~1 KB, JSON |
| signature | PKCS#7 detached signature of manifest.json | ~2 KB, DER |
| background.png | Background for boarding pass | optional |
Example pass.json for a Loyalty Card
{
"formatVersion": 1,
"passTypeIdentifier": "pass.com.yourcompany.membercard",
"serialNumber": "user-12345-XXXX",
"teamIdentifier": "ABCD1234EF",
"organizationName": "Your Company",
"description": "Member Card",
"foregroundColor": "rgb(255, 255, 255)",
"backgroundColor": "rgb(15, 82, 186)",
"storeCard": {
"primaryFields": [{"key": "member_name", "label": "Member", "value": "Ivan Petrov"}],
"secondaryFields": [{"key": "points", "label": "Points", "value": "1 250", "changeMessage": "Points updated: %@"}],
"auxiliaryFields": [{"key": "tier", "label": "Status", "value": "Gold"}],
"backFields": [{"key": "terms", "label": "Terms", "value": "Points valid for 12 months from accrual."}]
},
"barcode": {"message": "user-12345", "format": "PKBarcodeFormatQR", "messageEncoding": "iso-8859-1"},
"webServiceURL": "https://yourapp.com/wallet/",
"authenticationToken": "vxwxd7J8AlNNFPS8k0a0FfUFtq0ewzV"
}
Key fields: webServiceURL and authenticationToken — they enable push updates. Apple Wallet will register the device on your server and request an updated pass when changes occur.
Why Properly Signing pkpass Is Critical
An incorrect signature results in an error when adding the pass. Ensure the Pass Type ID certificate is issued for the same passTypeIdentifier used in pass.json. Use the correct chain: your certificate + WWDRCA. Our Python implementation using cryptography guarantees compatibility. Server-side generation averages 0.2 seconds, whereas attempting it on the client (if the key were available) would take 3–5 seconds due to mobile processor limitations. The server approach is 15 times faster and completely secure. Infrastructure cost reduction reaches 50% by eliminating client-side processing.
Step-by-Step pkpass Generation Setup
- Create a Pass Type ID in Apple Developer Portal and attach a certificate to it.
- Deploy a server module in Python or Node.js — our code is ready for integration.
- On iOS, call
PKAddPassesViewControllerafter downloading the.pkpass. - Configure push notifications via APNs for automatic updates.
Each step has been tested on dozens of projects — typical errors with authenticationToken and certificate lifetime are eliminated.
Server-Side Generation in Python
import hashlib
import json
import zipfile
import io
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.serialization import pkcs12
from cryptography.hazmat.backends import default_backend
from cryptography import x509
from cryptography.hazmat.primitives.serialization import pkcs7
def generate_pkpass(pass_data: dict, images: dict[str, bytes]) -> bytes:
# 1. Serialize pass.json
pass_json = json.dumps(pass_data, ensure_ascii=False).encode('utf-8')
# 2. Build manifest — SHA1 of all files
manifest = {}
files = {"pass.json": pass_json, **images}
for filename, content in files.items():
manifest[filename] = hashlib.sha1(content).hexdigest()
manifest_json = json.dumps(manifest).encode('utf-8')
# 3. Sign manifest with PKCS#7 detached signature
with open("pass-cert.p12", "rb") as f:
p12_data = f.read()
private_key, certificate, chain = pkcs12.load_key_and_certificates(
p12_data, b"p12_password", default_backend()
)
# Load Apple WWDR certificate (intermediate CA)
with open("AppleWWDRCA.cer", "rb") as f:
wwdr_cert = x509.load_der_x509_certificate(f.read(), default_backend())
signature = pkcs7.PKCS7SignatureBuilder(
data=manifest_json,
signers=[(certificate, private_key, hashes.SHA256())]
).add_certificate(wwdr_cert).sign(
encoding=serialization.Encoding.DER,
options=[pkcs7.PKCS7Options.DetachedSignature]
)
# 4. Package into ZIP
buffer = io.BytesIO()
with zipfile.ZipFile(buffer, 'w', zipfile.ZIP_DEFLATED) as zf:
zf.writestr("pass.json", pass_json)
zf.writestr("manifest.json", manifest_json)
zf.writestr("signature", signature)
for filename, content in images.items():
zf.writestr(filename, content)
return buffer.getvalue()
The Pass Type ID certificate is created in Apple Developer Portal → Certificates, Identifiers & Profiles → Identifiers → Pass Type IDs.
How to Open pkpass on iOS
On the client side, use PKPass and PKAddPassesViewController. Ensure the file is downloaded with the correct MIME type application/vnd.apple.pkpass.
import PassKit
func downloadAndAddPass(url: URL) {
URLSession.shared.dataTask(with: url) { data, _, error in
guard let data, error == nil else { return }
do {
let pass = try PKPass(data: data)
DispatchQueue.main.async {
let vc = PKAddPassesViewController(pass: pass)!
self.present(vc, animated: true)
}
} catch {
print("Invalid pass: \(error)")
}
}.resume()
}
How Push Updates via APNs Work
When data changes (points awarded, status changed), the server retrieves the device pushToken from the database, sends an empty push via APNs to the passkit production endpoint. Wallet performs a GET to /wallet/v1/passes/{passTypeIdentifier}/{serialNumber} with a Bearer token. The response is an updated .pkpass. Wallet applies changes and displays changeMessage if set in pass.json. Thanks to this mechanism, updates happen within 1–2 seconds, saving up to 80% of traffic compared to periodic polling, and server load is reduced by 3 times.
Deliverables
Our team handles the full cycle — from certificate creation to server module deployment. You receive:
| What's Included | Description |
|---|---|
| Pass Type ID issuance | Create identifier and certificate in Apple Developer Portal |
| Server module | API in Python/Node.js for pkpass generation with error handling |
| iOS client | Integration of PKAddPassesViewController and deep link handling |
| Push updates | APNs mechanism for automatic pass updates |
| Documentation | Maintenance guide with request examples |
| Support | 2 weeks of warranty support after deployment |
Why Choose Us
- 10+ years of experience in iOS development and backend integrations — we've solved over 50 Wallet Pass tasks.
- Server-side generation is implemented in 2 days for a basic scenario; push updates take an additional 1 day.
- Trust is confirmed by client reviews; recommendations available from retail and aviation clients.
- We offer a free project analysis: contact us for a consultation. Receive an accurate assessment and proposal.
Timelines and Pricing
Basic integration (server-side generation, download endpoint, iOS opening) takes from 2 days. Adding push updates takes another day or more. Pricing is determined individually based on backend complexity and any additional styling needs. Get a consultation — we'll evaluate the scope and propose an optimal solution. Request implementation and see the reliability of the solution.