{"templateId":"markdown","sharedDataIds":{},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Decrypted Apple Pay and Google Pay Tokens"},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"decrypted-apple-pay-and-google-pay-tokens","__idx":0},"children":["Decrypted Apple Pay and Google Pay Tokens"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you decrypt Apple Pay or Google Pay tokens yourself, for example because you hold your own Apple Pay certificate or Google Pay keys, you can send the decrypted network token to Ryft in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," field. Send the cryptogram from the decrypted token in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If you would rather Ryft decrypts the token, send the encrypted token in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletDetails"]}," instead, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/overview/payment_types/apple_google_pay"},"children":["Apple Pay & Google Pay"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your account must be enabled to send wallet network tokens, and you must be PCI SAQ-D compliant, as with sending ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cardDetails"]}," from your server. Contact Ryft to have this enabled."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"requirements","__idx":2},"children":["Requirements"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To send decrypted wallet tokens, you must ensure that the following requirements are met:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your account is PCI SAQ-D compliant and enabled for ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/get_started/process_payments/server_to_server"},"children":["Server-To-Server Payments"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your account is enabled to send wallet network tokens."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["You decrypt the Apple Pay or Google Pay token on your own servers and extract the network token (DPAN), its expiry and the cryptogram."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"sending-decrypted-wallet-tokens","__idx":3},"children":["Sending Decrypted Wallet Tokens"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can send ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]},":"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["to ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/api/reference/openapi#operation/paymentSessionAttemptPayment"},"children":["paymentSessionAttemptPayment"]},", when calling it with your secret API key, alongside ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["when creating a payment session with ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/api/reference/openapi#operation/paymentSessionCreate"},"children":["paymentSessionCreate"]},", as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attemptPayment.walletNetworkToken"]},", alongside ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters"]}]}]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Field"},"children":["Field"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Description"},"children":["Description"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken.number"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. The network token number (DPAN) from the decrypted token."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken.expiryMonth"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. The 2-digit expiry month of the network token."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken.expiryYear"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. The 4-digit expiry year of the network token."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken.name"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The cardholder's name."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken.walletType"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["ApplePay"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["GooglePay"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters.authenticationValue"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Required. The cryptogram from the decrypted token."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters.eci"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The ECI from the decrypted token. Send it when the wallet provides one."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters.protocolVersion"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters.dsTransactionId"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Optional. Validated if sent."]}]}]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","data-title":"Attempt Payment - Wallet Network Token Example","header":{"title":"Attempt Payment - Wallet Network Token Example","controls":{"copy":{}}},"source":"{\n    \"clientSecret\": \"ps_01FCTS1XMKH9FF43CAFA4CXT3P_secret_b83f2653-06d7-44a9-a548-5825e8186004\",\n    \"walletNetworkToken\": {\n        \"number\": \"4444333322221111\",\n        \"expiryMonth\": \"10\",\n        \"expiryYear\": \"2028\",\n        \"walletType\": \"ApplePay\"\n    },\n    \"authenticationParameters\": {\n        \"eci\": \"05\",\n        \"authenticationValue\": \"AAABBEg0VhI0VniQEjRWAAAAAAA=\"\n    }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","data-title":"Create Payment Session - Wallet Network Token Example","header":{"title":"Create Payment Session - Wallet Network Token Example","controls":{"copy":{}}},"source":"{\n    \"amount\": 54550,\n    \"currency\": \"GBP\",\n    \"customerEmail\": \"test@mail.com\",\n    \"attemptPayment\": {\n        \"walletNetworkToken\": {\n            \"number\": \"4444333322221111\",\n            \"expiryMonth\": \"10\",\n            \"expiryYear\": \"2028\",\n            \"walletType\": \"GooglePay\"\n        }\n    },\n    \"authenticationParameters\": {\n        \"eci\": \"05\",\n        \"authenticationValue\": \"AAABBEg0VhI0VniQEjRWAAAAAAA=\"\n    }\n}\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"restrictions","__idx":4},"children":["Restrictions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," cannot be used:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["with your public API key"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["paymentMethodOptions.store"]}," set to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["true"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["for MOTO or in-person payments"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Only one payment option can be sent per payment attempt: one of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cardDetails"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletDetails"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["paymentMethod"]},". When creating a payment session, ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attemptPayment"]}," can only contain one of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["paymentMethod"]}," or ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]},"."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"warning"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A Google Pay token with the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["PAN_ONLY"]}," authentication method decrypts to the customer's card number, not a network token. Never send it as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]},". Send it as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["cardDetails"]},", either with Ryft performing 3DS or with your own 3DS result in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters"]},", see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/get_started/initiate_payments/additional_settings/3ds-configuration#how-to-use-your-own-3ds-authentication"},"children":["How to Use Your Own 3DS Authentication"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"errors","__idx":5},"children":["Errors"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If a request with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," is not valid, it is rejected with a 400. The errors you are most likely to see are:"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Error"},"children":["Error"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Reason"},"children":["Reason"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'walletNetworkToken' cannot be supplied when using your public api key"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," was sent to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attempt-payment"]}," with your public API key. Call it from your server with your secret API key."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'walletNetworkToken' is not enabled on your account - please contact support"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Your account is not enabled to send wallet network tokens. When creating a payment session, the error refers to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'attemptPayment.walletNetworkToken'"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'authenticationParameters' must be provided with 'walletNetworkToken'"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["walletNetworkToken"]}," was sent without ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters"]},". When creating a payment session, the error refers to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'attemptPayment.walletNetworkToken'"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationParameters.<field> must be provided with 'walletNetworkToken'"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A field required with a wallet network token is missing, for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["authenticationValue"]},"."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'paymentMethodOptions.store' cannot be true with 'walletNetworkToken'"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Wallet network tokens cannot be stored."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'walletNetworkToken' cannot be supplied for payment session '<id>' as it cannot be used for MOTO or in-person payments"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["The payment session is a MOTO or in-person payment."]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["'attemptPayment' can only contain one of: [cardDetails, walletNetworkToken, paymentMethod]"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["More than one payment option was sent in ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attemptPayment"]}," when creating a payment session."]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"next-steps","__idx":6},"children":["Next Steps"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To send card details from your server, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/get_started/process_payments/server_to_server"},"children":["Server-To-Server Payments"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To let Ryft decrypt the token instead, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/overview/payment_types/apple_google_pay"},"children":["Apple Pay & Google Pay"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["To send the result of 3DS you perform yourself, see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/documentation/get_started/initiate_payments/additional_settings/3ds-configuration#how-to-use-your-own-3ds-authentication"},"children":["How to Use Your Own 3DS Authentication"]},"."]}]}]},"headings":[{"value":"Decrypted Apple Pay and Google Pay Tokens","id":"decrypted-apple-pay-and-google-pay-tokens","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Requirements","id":"requirements","depth":2},{"value":"Sending Decrypted Wallet Tokens","id":"sending-decrypted-wallet-tokens","depth":2},{"value":"Restrictions","id":"restrictions","depth":2},{"value":"Errors","id":"errors","depth":2},{"value":"Next Steps","id":"next-steps","depth":2}],"frontmatter":{"seo":{"title":"Decrypted Apple Pay and Google Pay Tokens"}},"lastModified":"2026-11-03T10:01:29.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/documentation/get_started/process_payments/decrypted_wallet_tokens","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}