Apple Pay
Two ways to accept Apple Pay with Tonder: Managed, on Tonder's Apple registration, or Bring Your Own, with your own Merchant ID.
Apple Pay lets a shopper pay with the card already in their Wallet, with Face ID or Touch ID instead of a card form. Tonder runs it in two models, and the difference is one question: whose Apple Merchant ID does the payment run under? Either way, the result is a Tonder transaction with the webhooks you already handle.
Two ways to accept Apple Pay
Managed Apple Pay — Tonder's Merchant ID and certificate. You send Tonder your domains, host one verification file, and the Web SDK button or Hosted Checkout 2.0 renders Apple Pay. No Apple Developer account, nothing to renew. This is the model most merchants start with.
Bring Your Own Apple Pay — your Merchant ID, created in your own Apple Developer account. Tonder generates the certificate request, you create the Payment Processing Certificate in Apple, and Tonder keeps the key that decrypts your shoppers' tokens. Your website or iOS app obtains the Apple Pay token and sends it to Tonder through the Direct API. Apple knows your business as the merchant.
Managed or Bring Your Own?
| Managed Apple Pay | Bring Your Own Apple Pay | |
|---|---|---|
| Apple Merchant ID | Tonder's | Yours, created in your Apple Developer account |
| Apple Developer account | Not needed | Required, with Account Holder or Admin access |
| Where the button lives | Web SDK button · Hosted Checkout 2.0 | Your web page or your iOS app, through the Direct API |
| Domain verification | Tonder's file, verified by Tonder | Apple's file, verified in your own account |
| Certificates | Managed by Tonder | Payment Processing Certificate created from Tonder's CSR; renewed every 25 months |
| Token decryption | Tonder's key | The key paired to your certificate, held by Tonder |
| Result | A Tonder transaction and the usual webhooks | The same, as any Direct API payment |
| Availability | Enabled per business | Enabled on request through your Tonder representative |
| Best for | The fastest launch, no Apple paperwork | Your brand as the merchant, a Merchant ID you already have, a native iOS app |
Which one is for you
- No Apple Developer account, or you want Apple Pay this week → Managed.
- You already have a Merchant ID, or Apple must see your business as the merchant → Bring Your Own.
- You are adding Apple Pay to a native iOS app → Bring Your Own: the same Merchant ID and certificate serve your website and your app.
- Your stack is Direct API only and you would rather not add a browser SDK → Bring Your Own, or Managed through Hosted Checkout 2.0, where Tonder's page renders the button.
Whichever you choose, test in Safari on a real Apple device with the cards below.
Sandbox test cards
Apple's sandbox cards work for both models. Tonder's own test cards (4000 0000 0000 0077 and the rest of
Card test cases) cannot be added to Wallet — Apple's sandbox only
provisions Apple's own test credentials. To run a real Apple Pay sheet in sandbox:
In App Store Connect go to Users and Access → Sandbox → Testers and invite a tester.
Sign out of iCloud on the test iPhone or iPad and sign in with the sandbox tester account. The device region must be one where Apple Pay is available.
Wallet → Add Credit or Debit Card, enter one of the cards below manually, then open your checkout in Safari and pay.
Apple lists these as its latest FPANs (August 2025). Only the networks Tonder processes are reproduced here; the full list is on Apple Pay sandbox testing.
Visa
| Card number | Expiry | CVV |
|---|---|---|
4622 9431 2318 9285 | 12/2028 | 096 |
4622 9431 2318 9293 | 12/2028 | 413 |
4622 9431 2318 9301 | 12/2028 | 752 |
4622 9431 2318 9319 | 12/2028 | 356 |
4622 9431 2318 9327 | 12/2028 | 994 |
4622 9431 2318 9335 | 12/2028 | 777 |
4622 9431 2318 9343 | 12/2028 | 868 |
4622 9431 2318 9350 | 12/2028 | 792 |
4622 9431 2318 9368 | 12/2028 | 161 |
4622 9431 2318 9376 | 12/2028 | 732 |
Mastercard
| Card number | Expiry | CVC |
|---|---|---|
5204 2452 5046 0049 | 01/30 | 111 |
5204 2452 5052 2095 | 01/30 | 111 |
5204 2452 5110 7599 | 01/30 | 111 |
5204 2452 5305 0839 | 01/30 | 111 |
5204 2452 5471 8095 | 01/30 | 111 |
American Express — provisions only when the device region is set to the United States or
the United Kingdom. If Wallet asks for an OTP, enter 111111.
| Card number | Region | Expiry | CID |
|---|---|---|---|
37273 57230 32000 | United States | 12/28 | 7777 |
37272 79248 51007 | United States | 12/28 | 1111 |
37272 67850 11008 | United States | 12/28 | 1111 |
37677 17299 24003 | United States | 12/28 | 1111 |
37677 47309 52005 | United States | 12/28 | 1111 |
37420 05569 95003 | United Kingdom | 12/28 | 1111 |
37420 05590 81009 | United Kingdom | 12/28 | 1111 |
37420 05605 82003 | United Kingdom | 12/28 | 1111 |
37420 07381 38001 | United Kingdom | 12/28 | 7777 |
These cards work only in Apple's sandbox. They will not provision on a production Apple ID and
must never be used against app.tonder.io. The expiry Wallet shows for the device card (DPAN)
does not need to match the one above.
Next steps
Managed Apple Pay
Tonder's Merchant ID: the checklist, the Web SDK button and the troubleshooting table.
Bring Your Own Apple Pay
Your Merchant ID and certificate, with the Direct API.
Apple Pay demo
The Managed button, live — open it in Safari.
Hosted Checkout 2.0
Add apple_pay to payment_method_types and Tonder's page shows the button.
Webhooks
Confirm the payment server-side.