Apple Pay网页端与APP端支付令牌是否存在差异？技术求助

Great question—this is a super common pitfall when trying to cross-use Apple Pay tokens between web and app environments, and those unrecognized differences are exactly why your payments keep getting rejected. Let’s break down the key distinctions, using your provided web token as a reference:

Core Token Structure & Content Differences #

1. Transaction ID Validation #

• Web Apple Pay: The transactionId in your example (a5...3e) is a 16-byte random hex string generated by Safari, tied exclusively to the browser’s payment session and your registered merchant domain.
• In-App Apple Pay: The transactionId is generated by Apple’s Pay framework directly within your app, and it’s tightly linked to your app’s bundle ID and the specific in-app payment session context. Processors like Worldpay explicitly validate that this ID comes from a registered app bundle—not a web domain. Your web-generated ID fails this check immediately.

2. Header Field Discrepancies #

Your web token’s header only includes three fields: ephemeralPublicKey, publicKeyHash, transactionId. In-app tokens typically carry additional context that processors expect:

• applicationData: An optional but commonly required field that holds custom order/transaction data you pass from your app during payment initiation. Processors use this to verify session consistency and tie the token to a specific order.
• Some in-app scenarios also include signature-related metadata that web tokens don’t have, since web token signatures are domain-bound rather than app-bound.

3. Signature & Origin Context Validation #

Apple Pay tokens are cryptographically signed to prove their legitimate origin:

• Web tokens are signed using a key tied to your merchant domain (registered in the Apple Developer Portal).
• In-app tokens are signed using a key tied to your app’s bundle ID.
  Worldpay’s in-app payment endpoint checks the signature’s origin context—when it sees a web-signed token, it rejects it outright because it doesn’t match the expected app bundle ID context. You can’t fake this signature, as it’s generated by Apple’s servers based on the session’s origin.

4. Encryption Context Mismatch #

The ephemeralPublicKey in your web token is tied to the browser’s payment session encryption context. In-app tokens use a public key tied to the app’s payment session. When Worldpay attempts to decrypt the token, it expects the key to align with an app-based session—your web key doesn’t fit, leading to decryption failure or immediate rejection.

What You Should Do Next #

• Drop the "fake app" workaround: Apple and payment processors have strict, uncircumventable checks to prevent cross-environment token reuse, and this approach will never work reliably.
• Reach out directly to Worldpay: Ask if they offer a web-based Apple Pay integration path you might have missed, or if they can enable web support for your merchant account.
• If Worldpay can’t support web Apple Pay, consider switching to a payment processor that explicitly supports both web and in-app Apple Pay (most major providers do).

内容的提问来源于stack exchange，提问作者Viktor Holmberg