WalletWallet API

Changelog

What changed in WalletWallet API.

Batch import: turn a CSV into a batch of passes

  • Bulk passes is live in the dashboard: upload a CSV with one row per pass, design a single pass template, and generate the whole batch in one go.
  • CSV columns become {{column}} tokens anywhere in the template, so each pass carries its own row's name, member id, tier, or barcode value.
  • Batches process in the background. When one finishes, download a CSV with the serial number and share link for every row. Free plans generate up to 100 passes per batch, Pro up to 1,000.

Field labels are now optional

  • Every field label is now optional: omit label (or send an empty string) in primaryFields, secondaryFields, headerFields, or backFields and the value renders alone, with no label above it, on both wallets.
  • Built for value-only passes such as membership cards that show just the holder's name. A label-less primary field displays the value larger, and Google Wallet now accepts the save (a whitespace label used to break it with an empty subheader).
  • Legacy requests can do the same: send cardLabel: "" with title for a label-less title field. Omitting cardLabel keeps the CARD default, so nothing changes for existing integrations.

Upload size limits on passes and images

  • Each image is now capped at 1MB, the request body at 2MB, and the built .pkpass at 10MB. A request that exceeds any of these returns 400.
  • For crisp rendering, supply logoURL at 160×160 px, iconURL at 120×120 px, thumbnailURL at 180×180 px, and stripURL at 1080×360 px. These are the sizes the editor produces.

Code-less passes: the barcode is now optional

  • Omit barcodeValue to issue a pass with no barcode at all, on both wallets. Built for passes that are shown rather than scanned: completion certificates, membership and discount cards presented to staff, contact cards.
  • Nothing changes for existing integrations. When you do send a barcodeValue, a valid barcodeFormat is required exactly as before.

Bring your own Apple and Google credentials

  • The new BYOK plan signs passes with your own Apple Pass Type ID and mints Google passes from your own issuer, so passes are issued under your identity end to end. Feature access matches Pro, with a much higher monthly operation cap.
  • Apple private keys are never uploaded. We generate the keypair and hand you a certificate signing request; you upload it to the Apple Developer portal and send the issued .cer back. No openssl at any point.
  • Manage every credential from Dashboard › Certificates & Keys, or over the API at /api/credentials. Stored key material is encrypted at rest and never echoed back.
  • BYOK is not self-serve. Contact us and we will onboard you.

Revoke a pass with DELETE

  • New DELETE /api/passes/<serial> revokes a pass you issued (legacy alias DELETE /api/pkpass/<serial>).
  • Revoke invalidates the pass on every device it is installed on, on both wallets. Apple marks it voided and expired (greyed out, barcode dropped, filed under the holder's expired passes); Google moves it to the holder's expired passes.
  • See the Revoke a pass docs for the full behavior and response.

Pass Manager: manage every pass from the dashboard

  • Pass Manager lists every pass on your account, so you can find and edit one without writing any code. Included with Pro.
  • Search across your passes by their content, any field value such as a holder name, ticket number, or email, or by serial number.
  • See where each pass is live at a glance: how many Apple devices it is installed on, and whether it is saved to Google Wallet.
  • Open any pass in the editor pre-filled, change it, and push the update to every device it is installed on, on both wallets.
  • Export your passes to CSV (serial, title, holder, install counts, plus the share and edit links) for a spreadsheet or CRM.

Google Wallet support and a unified passes endpoint

  • Full Google Wallet support. Every pass you create now installs in both Apple Wallet and Google Wallet, with live push updates that reach both wallets from a single PUT.
  • New canonical POST /api/passes returns one JSON response with the Google Wallet save URL (googleSaveUrl), the signed Apple pass (applePass), and a shareUrl.
  • shareUrl is a hosted, share page at /p/<serial> that shows the right Add to Wallet button on a phone and a QR code to scan on desktop, so you can share a pass without building your own page.
  • Prefer the raw file? Add ?format=pkpass to stream the binary .pkpass straight to -o card.pkpass.
  • POST /api/pkpass and PUT /api/pkpass/<serial> keep working exactly as before. They will be retired in a future release, so point new integrations at /api/passes.
  • Read the announcement: One API, Two Wallets.

Control the Apple Wallet share button

  • New sharingProhibited field. It defaults to true to keep passes private (best for loyalty and membership cards). Set false to show the Apple Wallet share button on shareable passes.

Push updates, locations, and lock-screen banner text

  • Pass updates via push notifications with PUT /api/pkpass/<serial>
  • Lock-screen location triggers (up to 10 coordinates per pass)
  • changeMessage on field arrays to set the lock-screen banner text per field
  • iconURL to replace the lock-screen notification icon
  • Caller-supplied organizationName
  • X-Serial-Number response header on POST /api/pkpass

New pass customization parameters

  • stripURL for a wide banner image behind the primary field. It automatically switches the pass to a store card layout.
  • thumbnailURL for a square image in the top-right of the pass, ideal for a member photo or product shot.
  • cardLabel to replace the default "CARD" label above the pass title.
  • Live interactive pass preview added to the docs page.