Providing Merchant Validation

As soon as the system displays the payment sheet, the Apple Pay JS API calls your session object’s onvalidatemerchant event handler to verify that the request is coming from a valid merchant. It passes the function an ApplePayValidateMerchantEvent object that contains the validation URL.

In your onvalidatemerchant function:

1. You call your server, passing it the URL from the event’s validationURL property.

2. Your server uses the validation URL to request a session from the Apple Pay server, as described in Requesting an Apple Pay Payment Session. Never send the request for a merchant session from the client.

3. In response, your server receives an opaque merchant session object.

4. You pass the merchant session object to your Apple Pay session’s completeMerchantValidation method. You can use the merchant session object a single time. It expires five minutes after it is created.