Apple Wallet: Korti-issued or your own certificate
Apple only accepts passes signed by an approved issuer. Choose Path A, your own Apple certificate, or Path B, Korti issues on your behalf. Until one is set up, Apple passes are trial passes.
Why Apple needs a choice
Every Apple Wallet pass is signed with an Apple certificate that belongs to whoever issues it. So either your business is the issuer, with its own Apple Developer account (Path A), or Korti is, on your behalf, under an issuing agreement you sign (Path B). Apple confirmed in writing on 15 October 2026 that Path B complies with its rules.
Google Wallet works differently: Korti issues every Google pass under its own Google account, so there’s nothing to set up there.
The ways to issue
| Way | What it takes | Passes |
|---|---|---|
| Trial | Nothing. Every business starts here. | Signed with Korti’s trial certificate. They expire after 7 days, and you can hand out 25. For trying cards on real phones. |
| Path A: your own certificate | An Apple Developer Program membership ($99 USD a year, and a D-U-N-S number) and about ten minutes, once. | Signed with your certificate; your business is the issuer. They don’t expire. |
| Path B: Korti issues for you | You download Korti’s issuing agreement, sign it by hand and upload it (or email it to korti@korti.is). It licenses your name, logo and trademarks to Korti for your passes. Korti checks the signer’s kennitala in the company registry. If it confirms that the signer can bind your company, you can issue live passes as soon as you upload the signed copy; a person at Korti then reviews the agreement, usually within a day. | Signed with Korti’s certificate; Korti is the issuer, and the back of each pass says it was issued on your behalf, with your contact details. They don’t expire. |
Either way, passes stay trial passes until your business goes live: in the dashboard, Settings shows a checklist with three items, a company check, a payment card, and Apple Wallet (Path A or B). When all three are done, Apple and Google passes go live together.
Path B: sign the issuing agreement
- In Settings (or Settings → Apple Wallet), click Skrifa undir útgáfusamning.
- Say who signs, and what goes on the back of your passes: the phone, email and address your customers can contact. The signer should be someone the company registry shows can bind the company alone, such as a prókúruhafi. Tick that you may bind the company, and click Búa til samninginn.
- Download the agreement, which is filled in with the details you gave. It’s the full agreement in Icelandic, several pages long, and you can read it first at korti.is/skilmalar/utgafusamningur or on the page where you sign. The signer signs it on paper or in a PDF app, then you upload the signed PDF (or email it to korti@korti.is).
- Korti runs the registry check on the signer’s kennitala. If it confirms that the signer can bind your company, you can start issuing live passes straight away (up to 100 until the agreement is approved) while a person at Korti reviews the agreement, usually within a day. If Korti can’t approve it, the live passes you issued in the meantime are voided and stop working; trial passes aren’t affected. If the registry can’t confirm the signer (for example, the board signs jointly), nothing goes live until a person at Korti has approved the agreement. Korti may also reject it with a reason; you can have someone else sign, or use Path A instead.
Heads upMoving from Path B to Path A later is possible, but passes can’t change issuer, so customers re-add their cards. Korti keeps updating the Path B passes already in wallets.
Path A: connect your certificate, step by step
You don’t need a Mac. Korti makes the certificate signing request for you. In the dashboard, open Settings, then Apple Wallet, and follow along.
- Enrol in the Apple Developer Program as an organization. Enrol as a company, not an individual, so your company is the one Apple shows. Apple asks for your D-U-N-S number, which is free to get. Already a member? Skip to step 2. Enrol with Apple
- Create a Pass Type ID. In Certificates, Identifiers & Profiles, open Identifiers, click +, choose Pass Type IDs, and give it a description and an identifier such as
pass.is.yourcompany. Pass Type IDs - Download Korti’s certificate signing request. In Settings → Apple Wallet, click Sækja undirritunarbeiðni. It pairs with a private key that Korti stores encrypted and never shows.
- Create the certificate in Apple’s portal. Under Certificates, click +, choose Pass Type ID Certificate, pick the Pass Type ID from step 2, and upload the signing request. Download the
.cerfile Apple gives you. New certificate - Upload the .cer file to Korti. Korti checks that it’s a Pass Type ID certificate, that Apple issued it, that it was made from Korti’s signing request, and that it’s still valid. New Apple passes are then signed with it.
Heads upYour certificate expires after a year, and Korti warns you a month before. If it lapses, Apple passes can’t be issued or updated until you renew it. To renew, make a fresh signing request in Settings → Apple Wallet, and repeat steps 4 and 5 with the same Pass Type ID, so passes already in wallets keep updating.
What it means for the API
Nothing changes in your code. Passes issued before your business goes live have "trial": true and an expiresAt, on both wallets. When the trial is used up, POST /v1/passes returns 403 trial_limit until you go live (Settings → Live cards: a company check, a payment card and Apple Wallet). Live passes go in both wallets.
Passes already in wallets
New passes use the path you’re on. A pass already in someone’s wallet keeps the certificate it was issued with, because Apple doesn’t let a pass change issuer: trial passes stay trial passes until they expire, and Path B passes stay on Korti’s certificate. If a pass’s certificate is no longer connected, updating it returns 409 apple_certificate_gone; issue the customer a new pass instead.