Accepting an Apple Pay payment

You can choose to configure your Apple Pay integration using the payments APIs. This method requires you to first register your domains and subdomains in the Toast developer portal. For more information, see Registering and verifying a merchant domain.

Important

Apple Pay® is currently only available for Toast platform integrations on Apple’s Safari web browser.

The following procedure is an overview of how to configure and accept Apple Pay payments using the payments APIs. This procedure is separate from using the Toast developer portal to configure and enable Apple Pay as a payment method for use in the hosted checkout iframe.

  1. Register your domain for Apple Pay. You must register your domain and subdomains in the Toast developer portal. For more information, see Configuring Apple Pay in the Toast developer portal.

  2. Host the static domain verification file on all the domains and subdomains that will accept Apple Pay. For more information, see Hosting the static domain verification file.

  3. Build your Apple Pay integration that guests use to complete Apple Pay payments.

  4. Create a payment intent. You create the payment intent when the checkout page loads onto your website. For more information, see Creating a payment intent.

  5. Your customer selects the Apple Pay button on your checkout page. This opens and displays the Apple Pay payment sheet on your checkout page and creates an ApplePaySession. For more information, see ApplePaySession.

    When your integration displays the Apple Pay payment sheet, the Apple Pay JavaScript API automatically calls the onvalidatemerchant event handler. The onvalidatemerchant event handler validates your identity and confirms that your domain is registered with Apple and is authorized to process Apple Pay payments. If the validation is successful, the payment sheet appears on the checkout page for the customer to review and complete the transaction.

  6. Create an Apple Pay payment session by sending a POST request to the /digital-wallet-broker/v1/wallets/apple-pay/payment-session endpoint of the digital wallet broker API. This returns an Apple Pay payment session. The Apple Pay payment session manages various payment actions, such as verifying the merchant’s identity and handling customer actions.

    The Apple Pay payment session invokes the completeMerchantValidation function, which completes merchant validation and displays the payment sheet to the customer.

  7. When your customer approves the transaction, this invokes the Apple Pay JavaScript SDK onpaymentauthorized event handler. This event handler returns an ApplePayPayment object. The ApplePayPayment provides information about the customer’s payment credentials.

  8. Create a payment method by sending a POST request to the /v1/payment-methods endpoint of the payment methods API. Include the ApplePayPayment object in the request body.

  9. Confirm the payment intent by sending a POST request to the /v1/payment-intents/{paymentIntentId}/confirm endpoint of the payment intents API.

    If the payment intent was successfully confirmed, call Apple Pay JavaScript SDK completePayment with STATUS_SUCCESS. If the payment intent was not successfully confirmed, call completePayment with STATUS_FAILURE. For more information, see Apple Pay status codes.

Building an Apple Pay integration

After you have registered your domains and subdomains and hosted the static domain verification file, the next step is to build the Apple Pay payment interface. The Apple Pay payment interface is a web interface that customers use to complete Apple Pay payments. You use the Apple Pay JS API to build the interface and implement the following functions:

  • Determine whether a customer’s ordering device supports Apple Pay payments and can display Apple Pay payment controls.

  • Handle the interface events that occur when a customer makes an Apple Pay payment on your ordering interface.

Authorizing an Apple Pay transaction

Once you have successfully registered as an Apple Pay web merchant under the Toast platform, you can retrieve valid Apple Pay payment sessions through the Toast platform. You must successfully create an Apple Pay payment session to receive an ApplePayPayment you can use to create a payment method. The following sections describe how to authorize Apple Pay transactions in your integration.

Determining if Apple Pay is available

To authorize an Apple Pay transaction, you must first check if the Apple Pay JavaScript API is available and enabled in your integration. This ensures that your website only displays the Apple Pay button on supported browsers. To check if Apple Pay is available:

  • Check if ApplePaySession exists in a browser window. For more information, see Checking for Apple Pay availability.

    if (window.ApplePaySession) {
       // The Apple Pay JS API is available.
    }

  • Check if canMakePayments() returns true. For more information, see canMakePayments.

If both conditions are met, you can display the Apple Pay button on your checkout page.

Building the Apple Pay session object

After you have confirmed that Apple Pay is available and enabled in your integration, your customer's web browser will validate your merchant identity, retrieve the Apple Pay payment session, and display the Apple Pay payment sheet to the customer. The Apple Pay payment sheet displays the customer’s linked payment cards, the purchase amount, shipping options (if applicable), and contact information. To display the Apple Pay payment sheet, you must create an ApplePayPaymentRequest to attach to the Apple Pay payment session. For more information, see ApplePayPaymentRequest.

Defining the onvalidatemerchant event handler

The next step to authorizing an Apple Pay transaction is to define the onvalidatemerchant event handler. The onvalidatemerchant event handler is automatically invoked after the Apple Pay payment session has begun. For more information, see onvalidatemerchant.

Defining the onpaymentauthorized event handler

You must also define the onpaymentauthorized event handler. The onpaymentauthorized event handler is automatically invoked after the customer successfully authorizes the Apple Pay payment using Face ID, Touch ID, or a passcode. For more information, see onpaymentauthorized.

Defining secondary event handlers

You can define secondary event handlers to react to your customer’s actions in the Apple Pay payment sheet. You can define secondary event handlers for the following action types:

Note

This list is not comprehensive.

  • Handling payment method updates

  • Handling coupons

  • Handling shipping contact updates

  • Handling shipping method updates

For more information, see ApplePaySession.

Initiating an Apple Pay session

Important

Certain Apple Pay JavaScript SDK web browser behaviors such as opening a payment dialog require a user gesture (for example, a button select) to avoid unwanted actions such as unauthorized payments. Apple Pay payments must be initiated by a user gesture to ensure proper security and functionality.

To initiate an Apple Pay session, define the onvalidatemerchant event handler to send a POST request to the /digital-wallet-broker/v1/wallets/apple-pay/payment-session endpoint of the digital wallet broker API. Include the Toast-Restaurant-External-ID as a header parameter in the request to specify the GUID of the Toast POS location. In the request body, include the domain and the validationURL. This returns an ApplePaySession object. For more information, see ApplePaySession.

Example request body to initiate an Apple Pay session

{
    "validationURL": "https://apple-pay-gateway-cert.apple.com/paymentservices/paymentSession", 1
    "domain": "toasty.com", 2
    "paymentMethodDomainId": "d57daa6c-5384-431c-962f-a1b7551fbf49", 3
    "sessionSecret": "string" 4
}

1

The Apple Pay gateway URL. The validationURL is different for each Toast API environment:

  • Sandbox: apple-pay-gateway-cert.apple.com

  • Production: apple-pay-gateway.apple.com

2

The internet domain name used to submit an Apple Pay payment. The domain must match a domain you registered for your Apple Pay payment integration.

3

The identifier of the merchant domain. You can retrieve the paymentMethodDomainId from the Toast developer portal. For more information, see Configuring Apple Pay in the Toast developer portal.

4

A unique and randomized identifier for the payment intent. For more information, see Creating a payment intent.


Example response body to initiate an Apple Pay session

    "string" 1

1

For more information, see Providing merchant validation.


Creating a payment intent

Note

You can create the payment intent before or after your customer selects the Apple Pay button. Toast support recommends you create the payment intent before your customer selects the Apple Pay button.

To accept an Apple Pay payment on your checkout page, you need to create a payment intent. To create a payment intent for an Apple Pay transaction, send a POST request to the /v1/payment-intents endpoint of the payment intents API to return a PaymentIntentResponse object and a sessionSecret. Include the Toast-Restaurant-External-ID as a header parameter in the request to specify the GUID of the Toast POS location that you are creating a payment intent for.

Example request body to create a payment intent for an Apple Pay transaction

{
    "amount": 1000, 1
    "currency": "USD", 2
    "externalReferenceId": "73edc827-0c18-485f-b581-1ef79f93b940", 3
    "captureMethod": "MANUAL", 4
    "email": "john.smith@email.com" 5
}

1

The payment amount in minor currency units represented as a positive integer. The minimum amount is 0.01 (represented as .01). In this example, 1000 represents ten USD and zero cents.

2

The supported currency types are:

  • AUD

  • CAD

  • EUR

  • GBP

  • USD

3

The identifier for the payment intent generated by the Toast POS location or your integration. The externalReferenceId can be applied as a payment identifier for a Toast POS check.

Note

The hosted checkout integration does not validate and enforce the uniqueness of the externalReferenceId. The uniqueness of the externalReferenceId is only enforced when it is applied as a payment identifier for a Toast POS check.

4

Controls when funds are captured:

  • MANUAL: Places a hold on your customer’s funds when the payment is authorized. Funds are captured at a later date. Set this value to MANUAL.

  • AUTOMATIC: Funds are automatically captured when the gift card is authorized.

5

The customer's email address. The customer's email address only needs to be provided once when you create or confirm the payment intent.


Example response body to create a payment intent for an Apple Pay transaction

{
    "id": "86bbcf0c-b483-4bbc-81bf-c2a9cd2baa2c", 1
    "externalReferenceId": "73edc827-0c18-485f-b581-1ef79f93b940", 2
    "sessionSecret": "PI_86bbcf0c-b483-4bbc-81bf-c2a9cd2baa2c_SECRET_EqYQ5^CgQWc4J?KBwq2jfv&Ov", 3
    "amount": 1000,
    "currency": "USD",
    "captureMethod": "MANUAL",
    "status": "REQUIRES_PAYMENT_METHOD", 4
    "paymentMethodId": null,
    "creationDate": "2023-09-29T16:42:36.239579Z", 5
    "usage": null, 
    "customerId": null, 
    "amountDetails": {
        "tip": 0
    }, 
    "email": "john.smith@email.com", 
    "paymentMethodConfigurationDetails": { 
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08" 
    }, 
    "latestPayment": null, 
    "offSession": false,  
    "standingInstructionType": null, 
    "mandateId": null 
}

1

The identifier of the payment intent.

2

The identifier for the payment intent generated by the Toast POS location or your integration. The externalReferenceId can be applied as a payment identifier for a Toast POS check.

3

A unique identifier for the payment intent that you use to create a payment method.

4

The status of the payment intent. Values are:

  • REQUIRES_PAYMENT_METHOD

  • PROCESSING

  • REQUIRES_CAPTURE

  • SUCCEEDED

  • FAILED

  • CANCELLED

For more information, see Payment intent statuses.

5

The date and time the payment intent was created in ISO 8601 format. Toast support recommends that you store the creationDate in the server component of your integration. You use the creationDate to check that the payment intent has not expired. If the payment intent has expired, you must create a new payment intent.


Creating a payment method

After you create the payment intent and determine if Apple Pay is available, call applePaySession.begin(), to begin the merchant validation process. When you call the begin() method, this displays the Apple Pay payment sheet on your checkout page and initiates the merchant validation process by calling the onvalidatemerchant event handler and any other secondary handlers. For more information, see begin.

To create a payment method, define the onpaymentauthorized event handler. Your integration sends a POST request to the /v1/payment-methods endpoint of the payment methods API. Include the Toast-Restaurant-External-ID as a header parameter in the request to specify the GUID of the Toast POS location that you are creating a payment method for. In the request body, set the type value to CARD and include the Card object, which contains information about the payment card.

Include the following header parameters:

  • Toast-Session-Secret: The unique and randomized identifier for the payment intent. This is returned in the response to create a payment intent.

  • Toast-Idempotency-Key: An integration-generated universally unique identifier (UUID) that is used to recognize retries of the same request.

Example request body to create a payment method for an Apple Pay transaction

{
    "type": "CARD", 1
    "card": {
      "wallet": { 2
        "type": "APPLE_PAY",
        "applePayPayment": JSON.stringify(event.payment) 3
      }
    }
}

1

The type of payment method.

2

Digital wallet attributes. These attributes are required when creating an Apple Pay payment method. When present, the payment method type must be CARD and type identifies the digital wallet. Set the type value to APPLE_PAY.

3

An object that contains the customer’s payment credentials. For more information, see ApplePayPayment.


Example response body to create a payment method for an Apple Pay transaction

{
    "id": "f718c101-70e4-45fe-8fc1-67ba0a12a8c5", 1
    "type": "CARD", 
    "usage": null,
    "card": { 2
        "firstSix": "411111",
        "lastFour": "1111",
        "expiry": {
            "month": "12",
            "year": "27"
        },
        "brand": "VISA",
        "type": "VISA", 
        "fingerprint": "e19f9942-942b-4716-a45c-6ee69225970d", 
        "funding": "Debit",

        [contents omitted]
    }
}

1

The identifier of the payment method. Include the id in the request to confirm a payment intent. For more information, see Confirming a payment intent.

2

The payment method details for a CARD transaction.

Once you successfully created a payment method for an Apple Pay payment, you must confirm the payment intent in the onpaymentauthorized event handler.


Confirming a payment intent

The last step to completing an Apple Pay payment is to confirm the payment intent. Confirming the payment intent represents your customer’s intention to pay the amount with the attached payment method. If the payment intent is successfully confirmed, the Toast platform authorizes the Apple Pay payment.

Example request body to confirm a payment intent for an Apple Pay transaction

{
    "paymentMethodId": "f718c101-70e4-45fe-8fc1-67ba0a12a8c5", 1
    "sessionSecret": "PI_86bbcf0c-b483-4bbc-81bf-c2a9cd2baa2c_SECRET_EqYQ5^CgQWc4J?KBwq2jfv&Ov", 2
    "email": "john.smith@email.com" 3
}

1

The identifier of the payment method.

2

A unique and randomized identifier for the payment intent.

3

The customer's email address. The customer's email address only needs to be provided once when you create or confirm the payment intent.


Example response body to confirm a payment intent for an Apple Pay transaction

{
    "id": "86bbcf0c-b483-4bbc-81bf-c2a9cd2baa2c", 1
    "externalReferenceId": "73edc827-0c18-485f-b581-1ef79f93b940",
    "sessionSecret": "PI_86bbcf0c-b483-4bbc-81bf-c2a9cd2baa2c_SECRET_EqYQ5^CgQWc4J?KBwq2jfv&Ov",
    "amount": 1000,
    "currency": "USD",
    "captureMethod": "MANUAL",
    "status": "REQUIRES_CAPTURE", 2
    "paymentMethodId": "f718c101-70e4-45fe-8fc1-67ba0a12a8c5",
    "creationDate": "2023-09-29T16:42:36.239579Z",
    "usage": null,
    "customerId": "4b2dfc5a-88a3-11ee-b9d1-0242ac120002", 
    "amountDetails": {
        "tip": 0
    }, 
    "email": "john.smith@email.com", 
    "paymentMethodConfigurationDetails": { 
        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08"  
    },
    "latestPayment": { 3
        "card": {
             "brand": "VISA",
             "lastFour": "1111",
             "expiry": {
                 "month": "12", 
                 "year": "27"
             }  
         } 
    }, 
    "offSession": false,   
    "standingInstructionType": null, 
    "mandateId": null,
    "lastPaymentError": { 4
        "type": "CARD_DECLINED", 5
        "code": "DECLINE" 6
     }     
}

1

The unique identifier of the payment intent.

2

The status of the payment intent. For more information, see Payment intent statuses.

3

Payment card details associated with the latest payment intent.

4

Details about the payment card transaction failure. The LastPaymentError object is only returned if the payment intent cannot be confirmed.

5

The type of payment card error. Available values are:

  • CARD_DECLINED

  • FRAUDULENT

6

Additional information about why the payment card was declined. This value is only returned if the type is CARD_DECLINED. A FRAUDULENT payment card error type does not return a code value.

If the payment intent was successfully confirmed, call completePayment with STATUS_SUCCESS. If the payment intent was not successfully confirmed, call completePayment with STATUS_FAILURE. For more information, see Apple Pay status codes.