Skip to content
$349
Get it · $349 Try demo Docs
Sign in
Documentation
Back to Home Buy Reward Loyalty

Administrator setup and certificate custody.

Create the Apple Pass Type ID identity, configure Reward Loyalty, and plan renewal and recovery.

Sep 4, 2026

An administrator sets Apple Wallet up once for the whole Reward Loyalty installation. Businesses and members do not upload certificates.

What you need

  • An active Apple Developer Program membership. Apple currently lists it as 99 USD per membership year, or local currency where available; regional pricing and eligibility can change.
  • The Account Holder or Admin role on the correct Apple Developer team.
  • A Mac for the simplest certificate request and private-key export. Xcode is useful for Simulator testing but is not required on the production server.
  • Secure backup storage for the signing identity, its password, your Reward Loyalty APP_KEY, and private application storage.

Each company running its own independent Reward Loyalty installation should use a signing identity owned by that installation's operator. Individual businesses hosted as partners on one operator's installation do not each need an Apple Developer account: the operator signs all passes, while each business controls only its own programs and appearance.

1. Register a Pass Type ID

In Certificates, Identifiers & Profiles:

  1. Open Identifiers, select +, and choose Pass Type IDs.
  2. Give it a clear description, such as Reward Loyalty Production.
  3. Enter a permanent reverse-domain identifier, such as pass.com.example.rewardloyalty.
  4. Review and register it.

Treat the identifier as permanent. Existing passes cannot be moved to another Pass Type ID. Use a separate identifier and certificate for development or staging so a test never shares the production identity.

2. Create the certificate request on your Mac

  1. Open Keychain Access.
  2. Choose Keychain Access → Certificate Assistant → Request a Certificate from a Certificate Authority.
  3. Enter an email address you control and a recognizable common name.
  4. Leave the CA email address empty.
  5. Choose Saved to disk and save the .certSigningRequest file.

The private key is created in the selected Mac login keychain. The email is descriptive; signing authority comes from the Apple Developer team where you upload the request.

3. Create and export the Pass Type ID certificate

  1. Return to Certificates, Identifiers & Profiles → Certificates and select +.
  2. Under Services, choose Pass Type ID Certificate.
  3. Select the Pass Type ID from step 1 and upload the .certSigningRequest.
  4. Download the resulting .cer, then double-click it to install it in Keychain Access.
  5. In My Certificates, expand the Pass Type ID certificate and confirm its private key appears below it.
  6. Select the certificate and private key together, export them as a password-protected .p12, and store the password in your secret manager.

If the private key is absent, the certificate was created from a CSR whose key lives in another keychain. Find that Mac/keychain or create a new CSR and certificate. A .cer by itself cannot sign a pass.

4. Download the Apple WWDR intermediate

Pass Type ID certificates use Apple's Worldwide Developer Relations G4 intermediate. Download the active G4 certificate from Apple PKI and keep it with the signing identity. Eligible Xcode versions may install it in Keychain automatically, but Reward Loyalty still needs the uploaded .cer or .pem file so it can build the pass signature chain.

Do not substitute an Apple root certificate or another WWDR generation. Reward Loyalty validates the identity, private key, Pass Type ID, Team ID, chain, and expiry before saving it.

5. Configure Reward Loyalty

From the administrator dashboard

  1. Sign in as a full administrator.
  2. Open System settings → Integrations → Apple Wallet.
  3. Enter the exact Pass Type ID and 10-character Team ID shown in Apple Developer.
  4. Upload the password-protected .p12 and Apple WWDR certificate.
  5. Enter the .p12 password and choose Save and validate.
  6. Run the validation download and add the non-redeemable test pass on a test iPhone.

Saved files stay on the private credential disk, and the password is encrypted with APP_KEY. The password and private paths are write-only and never sent back to the browser.

From the server environment

Use absolute private paths outside the web root:

APPLE_WALLET_PASS_TYPE_IDENTIFIER=pass.com.example.rewardloyalty
APPLE_WALLET_TEAM_IDENTIFIER=A1B2C3D4E5
APPLE_WALLET_P12_PATH=/absolute/private/path/reward-loyalty.p12
APPLE_WALLET_P12_PASSWORD=use-your-secret-manager
APPLE_WALLET_WWDR_PATH=/absolute/private/path/AppleWWDRCAG4.cer

Dashboard values override these fallbacks. Clearing the dashboard override returns to the environment configuration.

Keep the default private cache unless your deployment has a deliberate alternative. The optional retention settings are:

APPLE_WALLET_CACHE_RETENTION_DAYS=30
APPLE_WALLET_EVENT_RETENTION_DAYS=90
APPLE_WALLET_AGGREGATE_RETENTION_MONTHS=24

The application bounds these values to safe ranges. Run the normal Laravel scheduler so lifecycle reconciliation and retention occur automatically; the Health Center also shows Apple Wallet operations state.

6. Badge artwork included with Reward Loyalty

Reward Loyalty includes Apple's official RGB “Add to Apple Wallet” SVG for every language the application supports. You do not need to visit Apple, accept a separate artwork download, rename files, or upload a badge.

The bundled set covers Arabic, Dutch, English, French, German, Indonesian, Italian, Japanese, Polish, Portuguese (Brazil), Spanish, and Turkish. Reward Loyalty chooses the member's language and falls back to English when needed. On a device that cannot add the pass, the member sees instructions to continue on an iPhone or compatible Mac.

Do not replace, recolor, crop, or redraw these files. A later Reward Loyalty release that adds an application language must also include Apple's matching official RGB badge. Until then, installing Apple's badges for languages that Reward Loyalty does not support adds no member-facing language option.

7. Plans and business overrides

Apple Wallet is on for Gold and Platinum by default. Change a plan in the plan editor, or open a business's Permissions tab to grant or revoke Apple Wallet for that business. The per-business choice wins over the plan.

Signing health and entitlement are separate: a business may be allowed to use Apple Wallet while the platform still blocks issuance because a certificate is missing, mismatched, or expired.

Keep a complete backup

Create the backup before the first live pass. Keep these files and values as one recovery set:

  • the .p12 containing certificate and private key;
  • its password;
  • the Apple WWDR file;
  • APP_KEY;
  • the private credential and pass-cache storage, according to your backup policy.

Store the .p12 password in a password manager. Store a second copy of the files somewhere outside the Reward Loyalty server. Test that an authorized administrator can find the backup and read its recovery instructions.

Renew the certificate without resetting

Your signing certificate expires. Your Apple Wallet identity does not. The identity consists of the Pass Type ID and Apple Team ID shown on the settings page.

Use the normal certificate form when the current certificate approaches its expiry date:

  1. In Apple Developer, create a replacement certificate for the same Pass Type ID.
  2. Install it in Keychain Access and confirm that its private key appears underneath it.
  3. Export the certificate and private key as a password-protected .p12.
  4. Open System settings → Integrations → Apple Wallet.
  5. Keep the existing Pass Type ID and Apple Team ID.
  6. Upload the new .p12, its password, and the current Apple WWDR file.
  7. Choose Save and validate.
  8. Download the administrator sample and add it to a test iPhone.

Do not use Reset Apple Wallet identity for certificate renewal. A renewal with the same Pass Type ID and Team ID keeps the current issuer identity and its pass registry.

What “Break glass” means

“Break glass” marks a last-resort recovery action. It changes the identity that signs every Apple Wallet pass on the installation. It does not fix an expired certificate, a wrong .p12 password, a missing WWDR file, or a business setting.

Opening Review reset steps is safe. It only reveals the explanation and confirmation form. Reward Loyalty changes nothing until you complete all three safeguards and press the red Reset identity button:

  1. confirm that you made the required backups;
  2. type RESET APPLE WALLET exactly;
  3. enter your current Reward Loyalty administrator password.

Use reset only in these cases

  • Your installation must move to a different Pass Type ID.
  • Your installation must move to another Apple Developer team and cannot keep its current identity.
  • Your incident-response plan requires you to abandon the current issuer identity.
  • Reward Loyalty already issued passes under the wrong identity, and you have prepared the correct replacement.

Ask the person responsible for your Apple Developer account or your support team if you are unsure. Pausing here does no harm.

Do not reset in these cases

  • The current signing certificate will expire or has expired. Renew it for the same Pass Type ID.
  • The Apple WWDR certificate has expired. Upload the current WWDR certificate.
  • Reward Loyalty rejects the .p12 password or file. Repair or re-export the certificate package.
  • One business no longer wants Apple Wallet. Remove that business's permission or disable its programs.
  • A member's points, stamps, voucher, or prepaid balance changed. The Apple pass does not show these values, so no new download is needed.
  • A test pass fails. Fix the reported configuration problem first.

Before you reset

Complete this preparation before opening the confirmation form:

  1. Back up the current .p12, its password, the WWDR file, APP_KEY, and private storage.
  2. Prepare the new Pass Type ID, Team ID, .p12, password, and WWDR file. Do not reset first and create them later.
  3. Note the issued-pass count shown on the page. This is the number of pass records that Reward Loyalty will disconnect.
  4. Tell affected businesses when new pass downloads will pause.
  5. Prepare a short message asking members to remove the old pass and add the new one after setup.
  6. Check whether the server environment contains APPLE_WALLET_* values. Plan to replace any value that points to the old identity.

What Reward Loyalty deletes

When you press Reset identity, Reward Loyalty:

  • removes the Apple Wallet credentials saved through the dashboard and deletes their managed private files;
  • deletes every issued Apple Wallet pass registry record;
  • deletes individual Apple Wallet download events;
  • deletes cached .pkpass packages;
  • blocks all new Apple Wallet downloads until the replacement identity passes validation;
  • records who requested the reset, when it happened, and how many pass records it affected.

The dashboard cannot undo this deletion. Your backup is the recovery source for the old signing files.

What remains after the reset

Members, points, stamps, vouchers, prepaid balances, and activity history remain in Reward Loyalty. Businesses, loyalty card definitions, program enablement, and appearance settings also remain.

Passes that members already added to Apple Wallet remain on their devices. Reward Loyalty cannot remove them. The new identity cannot update or replace them, so a member may see both the old and new pass until they remove the old one.

The reset does not revoke certificates or delete identifiers in Apple Developer. It does not remove backup files that you stored outside Reward Loyalty. Existing daily aggregate download totals remain until the normal retention process removes them.

Set up the new identity

After the reset, the page shows Awaiting a new Apple Wallet identity. New downloads remain unavailable.

  1. Replace old APPLE_WALLET_* environment values if the page lists them. The dashboard cannot edit server environment files.
  2. Enter the new Pass Type ID and Apple Team ID.
  3. Upload the matching .p12, password, and WWDR certificate.
  4. Choose Save and validate.
  5. Download the administrator sample and add it to a test iPhone.
  6. Check the Health Center. Signing and private storage should report a healthy state.
  7. Test one real pass before telling businesses that downloads are available again.

If validation fails, the old identity stays disabled. Read the error on the page, correct the replacement files, and try again. Member and loyalty data stay intact while you repair the setup.

Help businesses after the reset

Tell each affected business that its Apple Wallet settings remain in place. Ask it to check the pass preview and download a non-redeemable sample.

Members must return to their signed-in Reward Loyalty page and add a new pass. Tell them to remove the old pass from Apple Wallet so they do not keep two cards that look alike. Staff should scan a test pass and confirm that the usual sign-in, business, status, balance, and redemption checks still run.

If the private key or password may be compromised, revoke the affected certificate in Apple Developer. Preserve incident evidence without copying secrets into a ticket, then follow your incident-response policy. A revoked certificate alone does not always require a new Pass Type ID. Confirm that choice with the person who manages your Apple Developer team.