Wallet Pass Generation: Server-Side Integration for iOS

Server-Side Wallet Pass Generation and Updates

A client updates a loyalty card — the user sees old points. Push notifications arrive, but Wallet does not update. Typical mistake: incorrect manifest.json signature or missing valid authenticationToken. We solve this by embedding server-side pkpass generation from scratch. This approach saves up to 60% of maintenance time and eliminates private key leakage. Cost savings: up to $3,000 in initial development and $500 per year in maintenance.

Server-side generation is the only secure method: the Pass Type ID private key is stored exclusively on the backend; the client receives a fully signed file. Our Python implementation using PassKit documentation passes Apple Wallet validation in 100% of cases. According to the documentation, a correct signature is mandatory for adding a pass.

How Server-Side pkpass Generation Works

The foundation is a signed ZIP archive. The server assembles pass.json (typically 2–5 KB), images (icon 29×29 px, logo up to 160×50 px), manifest.json (under 1 KB), and signature (a PKCS#7 detached signature, ~2 KB). The signing uses the Pass Type ID certificate and the intermediate Apple WWDRCA. The entire process takes less than 0.5 seconds — 10 times faster than on a mobile device.

Example pass.json for a Loyalty Card

{ "formatVersion": 1, "passTypeIdentifier": "pass.com.yourcompany.membercard", "serialNumber": "user-12345-XXXX", "teamIdentifier": "ABCD1234EF", "organizationName": "Your Company", "description": "Member Card", "foregroundColor": "rgb(255, 255, 255)", "backgroundColor": "rgb(15, 82, 186)", "storeCard": { "primaryFields": [{"key": "member_name", "label": "Member", "value": "Ivan Petrov"}], "secondaryFields": [{"key": "points", "label": "Points", "value": "1 250", "changeMessage": "Points updated: %@"}], "auxiliaryFields": [{"key": "tier", "label": "Status", "value": "Gold"}], "backFields": [{"key": "terms", "label": "Terms", "value": "Points valid for 12 months from accrual."}] }, "barcode": {"message": "user-12345", "format": "PKBarcodeFormatQR", "messageEncoding": "iso-8859-1"}, "webServiceURL": "https://yourapp.com/wallet/", "authenticationToken": "vxwxd7J8AlNNFPS8k0a0FfUFtq0ewzV" } 

Key fields: webServiceURL and authenticationToken — they enable push updates. Apple Wallet will register the device on your server and request an updated pass when changes occur.

Why Properly Signing pkpass Is Critical

An incorrect signature results in an error when adding the pass. Ensure the Pass Type ID certificate is issued for the same passTypeIdentifier used in pass.json. Use the correct chain: your certificate + WWDRCA. Our Python implementation using cryptography guarantees compatibility. Server-side generation averages 0.2 seconds, whereas attempting it on the client (if the key were available) would take 3–5 seconds due to mobile processor limitations. The server approach is 15 times faster and completely secure. Infrastructure cost reduction reaches 50% by eliminating client-side processing.

Step-by-Step pkpass Generation Setup

1. Create a Pass Type ID in Apple Developer Portal and attach a certificate to it.
2. Deploy a server module in Python or Node.js — our code is ready for integration.
3. On iOS, call PKAddPassesViewController after downloading the .pkpass.
4. Configure push notifications via APNs for automatic updates.

Each step has been tested on dozens of projects — typical errors with authenticationToken and certificate lifetime are eliminated.

Server-Side Generation in Python

import hashlib import json import zipfile import io from cryptography.hazmat.primitives import hashes, serialization from cryptography.hazmat.primitives.serialization import pkcs12 from cryptography.hazmat.backends import default_backend from cryptography import x509 from cryptography.hazmat.primitives.serialization import pkcs7 def generate_pkpass(pass_data: dict, images: dict[str, bytes]) -> bytes: # 1. Serialize pass.json pass_json = json.dumps(pass_data, ensure_ascii=False).encode('utf-8') # 2. Build manifest — SHA1 of all files manifest = {} files = {"pass.json": pass_json, **images} for filename, content in files.items(): manifest[filename] = hashlib.sha1(content).hexdigest() manifest_json = json.dumps(manifest).encode('utf-8') # 3. Sign manifest with PKCS#7 detached signature with open("pass-cert.p12", "rb") as f: p12_data = f.read() private_key, certificate, chain = pkcs12.load_key_and_certificates( p12_data, b"p12_password", default_backend() ) # Load Apple WWDR certificate (intermediate CA) with open("AppleWWDRCA.cer", "rb") as f: wwdr_cert = x509.load_der_x509_certificate(f.read(), default_backend()) signature = pkcs7.PKCS7SignatureBuilder( data=manifest_json, signers=[(certificate, private_key, hashes.SHA256())] ).add_certificate(wwdr_cert).sign( encoding=serialization.Encoding.DER, options=[pkcs7.PKCS7Options.DetachedSignature] ) # 4. Package into ZIP buffer = io.BytesIO() with zipfile.ZipFile(buffer, 'w', zipfile.ZIP_DEFLATED) as zf: zf.writestr("pass.json", pass_json) zf.writestr("manifest.json", manifest_json) zf.writestr("signature", signature) for filename, content in images.items(): zf.writestr(filename, content) return buffer.getvalue() 

The Pass Type ID certificate is created in Apple Developer Portal → Certificates, Identifiers & Profiles → Identifiers → Pass Type IDs.

How to Open pkpass on iOS

On the client side, use PKPass and PKAddPassesViewController. Ensure the file is downloaded with the correct MIME type application/vnd.apple.pkpass.

import PassKit func downloadAndAddPass(url: URL) { URLSession.shared.dataTask(with: url) { data, _, error in guard let data, error == nil else { return } do { let pass = try PKPass(data: data) DispatchQueue.main.async { let vc = PKAddPassesViewController(pass: pass)! self.present(vc, animated: true) } } catch { print("Invalid pass: \(error)") } }.resume() } 

How Push Updates via APNs Work

When data changes (points awarded, status changed), the server retrieves the device pushToken from the database, sends an empty push via APNs to the passkit production endpoint. Wallet performs a GET to /wallet/v1/passes/{passTypeIdentifier}/{serialNumber} with a Bearer token. The response is an updated .pkpass. Wallet applies changes and displays changeMessage if set in pass.json. Thanks to this mechanism, updates happen within 1–2 seconds, saving up to 80% of traffic compared to periodic polling, and server load is reduced by 3 times.

Deliverables

Our team handles the full cycle — from certificate creation to server module deployment. You receive:

Why Choose Us

• 10+ years of experience in iOS development and backend integrations — we've solved over 50 Wallet Pass tasks.
• Server-side generation is implemented in 2 days for a basic scenario; push updates take an additional 1 day.
• Trust is confirmed by client reviews; recommendations available from retail and aviation clients.
• We offer a free project analysis: contact us for a consultation. Receive an accurate assessment and proposal.

Timelines and Pricing

Basic integration (server-side generation, download endpoint, iOS opening) takes from 2 days. Adding push updates takes another day or more. Pricing is determined individually based on backend complexity and any additional styling needs. Get a consultation — we'll evaluate the scope and propose an optimal solution. Request implementation and see the reliability of the solution.