<!--
{
  "documentType" : "article",
  "framework" : "ApplePayontheWeb",
  "identifier" : "/documentation/ApplePayontheWeb/providing-merchant-validation",
  "metadataVersion" : "0.1.0",
  "role" : "article",
  "title" : "Providing Merchant Validation"
}
-->

# Providing Merchant Validation

Validate your merchant identity and receive a session object for each payment request.

## Discussion

As soon as the system displays the payment sheet, the Apple Pay JS API calls your session object’s [`onvalidatemerchant`](/documentation/ApplePayontheWeb/ApplePaySession/onvalidatemerchant) event handler to verify that the request is coming from a valid merchant. It passes the function an [`ApplePayValidateMerchantEvent`](/documentation/ApplePayontheWeb/ApplePayValidateMerchantEvent) object that contains the validation URL.

> Important:
> The URL you receive can vary, so always use the URL provided in the ``doc://com.apple.applepayontheweb/documentation/ApplePayontheWeb/ApplePayValidateMerchantEvent/validationURL`` property. Your server must provide allow-listed access to all the validation URLs, specified in <doc://com.apple.documentation/documentation/ApplePayontheWeb/setting-up-your-server>.

In your [`onvalidatemerchant`](/documentation/ApplePayontheWeb/ApplePaySession/onvalidatemerchant) function:

1. You call your server, passing it the URL from the event’s [`validationURL`](/documentation/ApplePayontheWeb/ApplePayValidateMerchantEvent/validationURL) property.
2. Your server uses the validation URL to request a session from the Apple Pay server, as described in <doc://com.apple.documentation/documentation/ApplePayontheWeb/requesting-an-apple-pay-payment-session>. Never send the request for a merchant session from the client.
3. In response, your server receives an opaque merchant session object.
4. You pass the merchant session object to your Apple Pay session’s [`completeMerchantValidation`](/documentation/ApplePayontheWeb/ApplePaySession/completeMerchantValidation) method. You can use the merchant session object a single time. It expires five minutes after it is created.

## See Also

[Configuring Your Environment](/documentation/ApplePayontheWeb/configuring-your-environment)

Create your Apple Pay merchant ID and certificates, and verify your domain.

[Setting Up Your Server](/documentation/ApplePayontheWeb/setting-up-your-server)

Set up your server for secure communications with Apple Pay.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)