PAY-77Recommended

Verify your domains for Apple Pay and Google Pay

Register every domain and subdomain that shows a wallet button with the provider. Serve Apple's domain association file there with status 200 and no redirect.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Apple Pay on the web shows its button only on domains registered for your merchant ID. Apple checks the file at /.well-known/apple-developer-merchantid-domain-association on each domain. Each subdomain counts on its own, so shop.example.com needs its own entry. Most providers register the domain through their dashboard or API and give you the file to serve. The wallet sheet is the provider's own payment page. So it keeps you on SAQ A, as Choose a checkout that keeps you on SAQ A says. Serve it over HTTPS with a valid certificate. Leave the file name without an extension, and never redirect it, since Apple's check then fails. Google Pay on the web needs the site approved for production in the Google Pay and Wallet Console, unless your provider registers it for you. Add a new domain to the list before launch, not after customers miss the button. Add the file path to the allow list of standard addresses if your server blocks unknown paths.

Examples

JavaScript example

const WALLET_DOMAINS = ['example.com', 'shop.example.com']
const ASSOCIATION_PATH = '/.well-known/apple-developer-merchantid-domain-association'

for (const domain of WALLET_DOMAINS) {
  const response = await fetch(`https://${domain}${ASSOCIATION_PATH}`, { redirect: 'manual' })
  if (response.status !== 200) throw new Error(`${domain}: association file answered ${response.status}`)
}

Python example

import requests

WALLET_DOMAINS = ["example.com", "shop.example.com"]
ASSOCIATION_PATH = "/.well-known/apple-developer-merchantid-domain-association"

for domain in WALLET_DOMAINS:
    response = requests.get(f"https://{domain}{ASSOCIATION_PATH}", allow_redirects=False, timeout=10)
    assert response.status_code == 200, f"{domain}: association file answered {response.status_code}"

How to check

For each domain in the list, a request for /.well-known/apple-developer-merchantid-domain-association returns 200 with no redirect. The provider's dashboard or API lists the same domains as verified. A browser test on Safari staging shows the Apple Pay button.

Sources

PAY-1 Choose a checkout that keeps you on SAQ A in Payments and billing

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/payments/card-security-and-sca/wallet-domain-verification">Agent Wranglers payments and billing playbook</a>. In code you write, add a comment next to it with the same link.