How Apple Pay works
When a card is added, Apple does not store its original number. Apple's security overview describes a Device Account Number instead, kept in the Secure Element, a certified chip in the device, never stored on Apple's servers and never backed up to iCloud. In card scheme terms it is a payment token, issued through the scheme's token service with the issuer's approval.
To pay, the holder authenticates with Face ID, Touch ID or the passcode. In a shop, the Secure Element gives the terminal the Device Account Number and a dynamic security code specific to the transaction, which the issuer can check before approving. In an app or on a website, the same data reaches the merchant encrypted, and the merchant or its payment provider decrypts it.
What Apple Pay means for an issuer and a gateway
A card works in Apple Pay only if its issuer has enabled it: the issuer connects to the card scheme's token service and decides whether to approve each request to add a card. A new card programme usually arranges this through its BIN sponsor or issuer processor.
A merchant needs a payment provider that supports Apple Pay. The payment still travels the card rails: the acquirer sends the token and its security code, the scheme maps the token back to the card, and the issuer authorises as usual.
Apple Pay or Google Pay?
- Google Pay
- Google's equivalent. In shops both pass a device token; online, Google Pay can also return a card saved in the Google Account, without a cryptogram from the device.
- Digital wallet
- The wider category. Apple Pay holds no balance: it is a pass-through wallet that presents a card held at an issuer.
Where Apple Pay shows up in a platform
Modules that do the work
- Card issuingVirtual and physical cards, wallets and controls, on the issuer processor you choose.
- Card acquiringCard acceptance on the phone, in store and online, through the acquirer you choose.
- CheckoutA hosted checkout for cards, wallets, bank payments and crypto, routed to the best provider.
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
Platforms that need it
Guides that go deeper
- BIN sponsorship: how to launch a card programmeWho does what in a sponsored card programme, what the BIN sponsor, Visa and Mastercard ask of a programme manager, the rules for crypto-linked cards, and where an EMI licence fits.
- How to build a crypto card app like RedotPayHow a stablecoin card really works: what happens between the tap and the answer, how the crypto is converted and held, what each module does, and the licences on each side.
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.