Skip to main content

APPLE PAY · WEB DOMAINS

Domain association

Domain verification proves control of a website hostname. It does not create an MI certificate, activate a PP certificate or prove a payment succeeds.

Before registering

Identify the exact hostname where Apple Pay is used, the Merchant ID and the team that controls the web server. A PSP or commerce platform may manage this registration; use its procedure if it owns your integration.

For direct Apple Developer registration, example.com, www.example.com and checkout.example.com are different hostnames. Register and verify each one that you use; one file is not automatically valid for the others.

Register and verify

  1. With Account Holder or Admin access, open Apple Developer → Certificates, Identifiers & Profiles → Identifiers → Merchant IDs and select the merchant.
  2. Under Merchant Domains, choose Add Domain and enter the fully qualified hostname, without a scheme or page path.
  3. Download the association file. Publish its unchanged contents at the exact HTTPS path Apple specifies under /.well-known/; use the supplied filename, not an assumed extension.
  4. Confirm a direct HTTP 200 response containing that file, without login, redirects or a CDN/WAF challenge. Then choose Verify in Apple Developer and check Apple's resulting status.

The initial verification file is valid for seven days after generation. Only the newest generated file for that hostname is valid; replace an old download before retrying.

In AppsCert, Domains tracks desired versus observed state with human-confirmed propagation steps. Saving desired state does not register or verify a domain with Apple.

When verification fails

  • 200 with the wrong body: a catch-all app route, login page or CDN error is not the association file. Compare the served bytes with the download.
  • 301/302 or wrong hostname: serve the file directly on the registered host; do not redirect from apex to www or to another domain for this request.
  • Apple cannot connect: inspect HTTPS certificate trust/chain, DNS, firewall rules and proxy routing. Your browser reaching the file does not prove Apple can reach it.
  • Old or mismatched file: use the newest file for this exact hostname, within its initial verification window.

Keep verification valid

Domain verification expiry follows the website's HTTPS certificate, not the 25-month PP/MI lifetime. Renew HTTPS before expiry and keep both the association path and the hostname's root URL reachable for Apple's re-verification.

Apple retries automatic re-verification at 30, 15 and 7 days before HTTPS expiry. Check the portal after TLS, CDN or certificate-chain changes; if re-verification fails, follow Apple's manual verification procedure with a fresh file. Rotating PP or MI does not itself renew domain verification.

Finish with the consumer validation checklist, including a fresh merchant session for the affected site.

Apple references

Register and verify a merchant domain · Merchant configuration troubleshooting (TN3173) · Maintaining your environment

c3209c7