← library
No OAuth; merchant setup
Payments / Apple platform·agent-generated · deepseek-v4.1-flash·checked 2026-10-28
difficulty
5/5

Apple Pay has no third-party OAuth, so agents cannot get delegated payment authority; merchant integration instead needs the $99/yr Apple Developer Program, a Merchant ID, certificates/domain verification, and user Face ID/Touch ID at checkout, plus App Review for public apps.

First working connection
~3-8 hours after enrollment
Production / approved
~1-3 weeks incl. enrollment and App Review/PSP onboarding
Composio managed OAuth
Bring your own app
Not in Composio's managed-OAuth list — you'll need your own OAuth app (or it isn't a Composio toolkit yet).
who does itagent 2you 6provider 0
evidencetested 4sourced 33inferred 4
◆ agent run11 pages read27/31 quotes verified verbatim127s$0.024deepseek-v4.1-flash

01Pick your path

Supported PSP integration
when You want the fastest app or web checkout and your payment service provider already supports Apple Pay.
→ PSP SDK/API handles much of the payment flow; you still supply Apple merchant IDs, certificates, and domain verification where the PSP requires them.
Direct Apple Pay JS on the web
when You control the checkout and can host Apple’s domain verification file.
→ Merchant ID, payment processing certificate, merchant identity certificate, verified domain, and server-side merchant validation.
Native app with PassKit
when You ship an iOS/iPadOS app selling physical goods or services.
→ Enable the Apple Pay capability, use the Apple Pay API, and submit the app for App Review.
Sign in with Apple only
when You only need user login, not payment authorization.
→ OIDC scopes openid, email, and name; no payment authority and no Apple Pay delegation.

02Time & effort

Hands-on work
~2 workdays – ~3 workdays
Waiting on others
7 days – 2 weeks
You're actually working
8% of elapsed time
Phases
6
start↑ first working connection, then production pathproduction
  1. DEVEnroll and verify identity1–2 dayssourced[S1][S10]Apple may request a government ID, photo ID, or notarized business documents.
  2. DEVCreate Merchant ID and payment processing certificate30–60 minutessourced[S4]Requires Account Holder or Admin role; CSR is created on a Mac.
  3. DEVIntegrate PSP or Apple Pay APIs2–6 hourssourced[S5][S7][S11]Agent can draft code and configs; you supply PSP credentials and merchant identifiers.
  4. DEVVerify web domain and create merchant identity certificate30–90 minutessourced[S6]Only for Apple Pay on the web.
  5. DEVSandbox test on device and browser1–3 hourssourced[S5][S11]Use Apple’s demo and test cards; the user must approve the payment sheet.
  6. PRODApp Review or production rolloutwait 1–2 weekssourced[S2]Duration is inferred; Apple does not state review time in the source.
agent can do it you waiting on providerbar widths ∝ √time, so short tasks stay visible

03Steps

0/8 done

Get a working connection

  1. Set the agent boundaryagentsourced ❝[S3][S4]

    Apple Pay is not an OAuth API. The agent can prepare the cart and request, but the user must invoke the Apple Pay sheet and authenticate. Do not design a background charge flow.

    “Every transaction on your customer’s iPhone or iPad requires Face ID, Touch ID, or a passcode.” — [S3] verified verbatim
    ◆ prepared by agent · Agent handoff contract
    Agent may: build cart, compute total, construct PaymentRequest, reconcile server-side. Agent may not: store card data, approve payment, or impersonate the user. User must: tap Apple Pay and approve with Face ID/Touch ID/passcode.
  2. Enroll and verify identityyousourced ❝[S1][S10]

    Join the Apple Developer Program ($99/year) or use a free account for local testing. For distribution and capabilities, use the paid membership. Complete identity verification; organizations need D-U-N-S and binding authority.

    “Join the Apple Developer Program to reach customers around the world on the App Store for all Apple platforms.” — [S1] verified verbatim
    ↗ developer.apple.com/programs/
  3. Create a Merchant IDyousourced ❝[S4]

    In Certificates, Identifiers & Profiles, click Identifiers, add Merchant IDs, enter the description and identifier, review, and register. Use the same Merchant ID across apps.

    “Enter the merchant description and identifier name, then click Continue.” — [S4] verified verbatim
    ↗ developer.apple.com/help/account/configure-app-capabilities/configure-apple-pay/
  4. Create the payment processing certificateyousourced ❝[S4]

    Under the Merchant ID, create the Apple Pay Payment Processing Certificate. Generate a certificate signing request on a Mac, upload the .certSigningRequest, continue, and download the .cer file.

    “Create a certificate signing request on your Mac, then click Continue.” — [S4] verified verbatim
    ↗ developer.apple.com/help/account/configure-app-capabilities/configure-apple-pay/
  5. Verify the web domain and create merchant identity certificateyousourced ❝[S6]

    If using Apple Pay on the web: under Merchant Domains click Add Domain, enter the fully qualified domain, save, download Apple’s file, host it, then Verify. Create the Apple Pay Merchant Identity Certificate for server communication.

    “Under Merchant Domains, click Add Domain.” — [S6] verified verbatim
    ↗ developer.apple.com/help/account/capabilities/configure-apple-pay-on-the-web/
  6. Integrate via PSP or Apple Pay APIsagentsourced ❝[S7][S5][S11]

    Use a supported PSP/e-commerce platform for the fastest path, or implement Apple Pay JS/PassKit directly. The agent can draft server code, merchant validation, and payment-request construction; you supply PSP credentials and production identifiers.

    “Using an Apple Pay SDK or JavaScript API from a payment provider is the quickest and easiest way to support Apple Pay in your app or on your website.” — [S7] verified verbatim
    ↗ developer.apple.com/apple-pay/implementation/
  7. Sandbox test the checkoutyousourced ❝[S5][S11]

    Test on compatible iOS/Safari devices with Apple’s sandbox and test cards. Confirm the payment sheet appears, merchant validation succeeds, and server-side totals reconcile. The user must tap and authenticate.

    “The Apple Pay sandbox environment allows you test your implementation of Apple Pay with test credit and debit cards.” — [S5] verified verbatim
    ↗ applepaydemo.apple.com/

Make it production-ready

  1. Submit for App Review or production rolloutyousourced ❝[S2][S5]

    For App Store distribution, submit the app for review with a demo account or demo mode and live backend services. For web, confirm the implementation follows the Apple Pay on the Web Acceptable Use Guidelines before production.

    “If your app includes account-based features, provide either an active demo account or fully-featured demo mode, plus any other hardware or resources that might be needed to review your app (such as login credentials or a sample QR code).” — [S2] verified verbatim
    ↗ developer.apple.com/app-store/review/guidelines/

04Requirements, scopes & nuances

You'll need

  • ▸Apple Developer Program membership costs $99 per year and is required for distribution and access to capabilities and services. sourced ❝[S1]
  • ▸Identity verification is required: legal name, phone number, and address; organizations need a D-U-N-S Number and binding-authority reference. sourced ❝[S10]
  • ▸You need the Account Holder or Admin role to create Merchant IDs and certificates. sourced ❝[S4][S6]
  • ▸Create a Merchant ID; it never expires and can be reused across multiple apps. sourced ❝[S4][S6]
  • ▸Create a payment processing certificate associated with the Merchant ID; it expires every 25 months. sourced ❝[S4]
  • ▸For Apple Pay on the web, register the fully qualified merchant domain, verify it by hosting Apple’s file, and create a merchant identity certificate. sourced ❝[S6]
  • ▸Use a supported PSP/e-commerce platform or the Apple Pay APIs; contact the PSP for regional transaction requirements. sourced ❝[S5][S7]
  • ▸The user must approve each payment with Face ID, Touch ID, or passcode; you do not receive actual card numbers. sourced ❝[S3]
  • ▸App Store apps must pass App Review; web Apple Pay must follow the Apple Pay on the Web Acceptable Use Guidelines. sourced ❝[S5][S2]

Gotchas

  • !The OIDC discovery document at appleid.apple.com is Sign in with Apple, not Apple Pay; it advertises openid, email, and name only. Do not mistake it for payment authorization. tested[probe]
  • !Every Apple Pay transaction requires Face ID, Touch ID, or a passcode; an agent cannot silently approve a payment. sourced ❝[S3]
  • !The payment processing certificate expires every 25 months; the Merchant ID itself never expires and can be reused across apps. sourced ❝[S4]
  • !Apple Pay is not In-App Purchase: use Apple Pay for physical goods and services like groceries, clothing, hotel reservations, event tickets, and donations; use In-App Purchase for virtual goods and subscriptions. sourced ❝[S7]
  • !Web Apple Pay requires domain verification by hosting a downloaded file, plus a merchant identity certificate for server communication. sourced ❝[S6]
  • !Public App Store apps still go through App Review; account-based features need an active demo account or fully featured demo mode, and backend services must be live. sourced ❝[S2]
  • !Payment service providers and e-commerce platforms can shorten integration, but their onboarding and regional requirements are separate from Apple’s setup. inferred[S5][S7]
Scope / permissionTierNoteEvidence
No OAuth scopes for Apple PaygatedApple Pay grants no delegated OAuth scope. Payment authority is exercised through the Apple Pay sheet and user presence.inferred[S3][S4][S6]
Merchant ID / Apple Pay capabilitygatedThis is an Apple developer capability and certificate setup, not an OAuth scope.inferred[S4][S8]
openid email namebasicSign in with Apple OIDC scopes only. They identify the user and do not authorize payments.tested[probe]

05If you get blocked

✕The team expects OAuth scopes for Apple Pay.inferred[S4][S6][S5]

→ Do not look for an Apple Pay OAuth scope. Use merchant integration (Merchant ID, certificates, PSP or Apple Pay JS/PassKit) and use Sign in with Apple only for login.

✕An autonomous agent tries to complete payment without the user.sourced ❝[S3]

→ Have the agent construct the payment request and reconcile server-side; hand off to the user to tap Apple Pay and approve with Face ID, Touch ID, or passcode.

✕No Apple Developer account or identity verification.sourced ❝[S10][S1]

→ Enroll in the Apple Developer Program ($99/year), verify your legal identity, and for organizations provide a D-U-N-S Number and binding-authority reference.

✕Apple Pay on the web domain is not verified.sourced ❝[S6]

→ In Certificates, Identifiers & Profiles, add the fully qualified domain, download Apple’s file, host it at the specified location, then click Verify.

✕Payment processing certificate expired.sourced ❝[S4]

→ Recreate the payment processing certificate; calendar a renewal before the 25-month expiry.

✕App Review rejection or delay for an App Store app.sourced ❝[S2]

→ Follow App Review Guidelines, provide an active demo account or demo mode, and keep backend services live during review.

06Evidence: what was tested, sourced, and still uncertain

$ probes: live GETs with a dummy client_id, no credentials
✓ Discovery document (/.well-known/openid-configuration) → 200
https://appleid.apple.com/.well-known/openid-configuration
issuer=https://appleid.apple.com; authorization_endpoint=https://appleid.apple.com/auth/authorize; token_endpoint=https://appleid.apple.com/auth/token; scopes_supported=openid email name
∴ Confirms appleid.apple.com is a real OIDC issuer for Sign in with Apple with scopes openid, email, and name. It does not advertise Apple Pay scopes or payment endpoints; do not use it as Apple Pay OAuth.
✓ Authorize endpoint with a fake client_id → 403
https://appleid.apple.com/auth/authorize?client_id=probe_invalid_client&response_type=code&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback
text/html — HTML/login page
∴ A fake client_id returns 403 HTML/login, showing registered-client requirements. This is Sign in with Apple authorization, not a payment consent screen.

Sources read

  1. [S1] Apple Developer Program - Apple Developer official
  2. [S2] App Review Guidelines - Apple Developer official
  3. [S3] Apple Pay Overview - Apple Developer official
  4. [S4] Configure Apple Pay - Capabilities - Account - Help - Apple Developer official
  5. [S5] Implementing Apple Pay - Apple Developer official
  6. [S6] Configure Apple Pay on the web - Capabilities - Account - Help - Apple Developer official
  7. [S7] Merchant Integration Guide 24-MAR-2026 official
  8. [S8] Register an App ID - Identifiers - Account - Help official
  9. [S9] Mini Apps Partner Program - Apple Developer Program - Apple Developer official
  10. [S10] Identity verification - Membership - Account - Help - Apple Developer official
  11. [S11] Apple Pay on the Web Demo official
  12. [composio] Composio — Managed OAuth apps directory official
  13. [probe] Live HTTP probes run by the agent (dummy client_id, no credentials) probe

Still uncertain

  • ? Apple Pay exposes no third-party OAuth in the fetched documentation; the conclusion is based on the merchant-only setup and user-presence model, not a single explicit 'no OAuth' sentence.
  • ? App Review and PSP onboarding durations are not stated in the sources; all phase timings are inferred.
  • ? The probes test appleid.apple.com OIDC (Sign in with Apple), not Apple Pay endpoints.
  • ? Regional requirements for direct web merchant registration and PSP onboarding are not covered by the sources.
  • ? Identity verification timing varies; Apple may request photo ID or notarized business documents.
  • ? Generated automatically; no app was registered and no review was submitted.