Apple Pay for Kenyan Merchants on Paystack

Apple Pay is a tokenized card payment system. Here is what happens when a customer taps "Pay with Apple Pay" at your checkout:

1. The customer has a card saved in Apple Wallet. This is a Visa, Mastercard, or other supported card that they added to their iPhone, iPad, Apple Watch, or Mac. Kenyan banks that issue Visa and Mastercard debit and credit cards support Apple Wallet.
2. At checkout, they tap the Apple Pay button. A payment sheet appears showing the amount and merchant name.
3. They authenticate. Face ID on newer iPhones, Touch ID on older ones, or a passcode. This replaces the need to type card numbers, expiry dates, and CVVs.
4. Apple sends a payment token. This token represents the card details in an encrypted, single-use format. The actual card number is never shared with you or with Paystack directly.
5. Paystack processes the token. Paystack decrypts the token and charges the card through the card network (Visa/Mastercard). From your perspective, it is a card payment with extra security and less friction.
6. You get a webhook. The charge.success event arrives at your webhook endpoint, just like any other payment.

The key insight: Apple Pay is not a separate payment rail. It is a better front end for card payments. The money still moves through Visa/Mastercard. Apple Pay just replaces the part where the customer types their card number with a biometric authentication step.

This means Apple Pay transaction fees are typically the same as card transaction fees on Paystack. You are not paying extra for Apple Pay. Check paystack.com/pricing for current rates.

Before Apple Pay works on your website, you need to verify your domain with Apple. Paystack handles most of this process through their dashboard.

Steps:

1. Log into your Paystack dashboard. Go to Settings, then Apple Pay (the exact navigation may be under Payment Methods or Channels).
2. Add your domain. Enter the domain where you will accept Apple Pay (e.g., yourapp.co.ke). If you have multiple domains (e.g., www.yourapp.co.ke and yourapp.co.ke), add each one.
3. Download the verification file. Paystack provides a file (usually named apple-developer-merchantid-domain-association) that you need to host on your server.
4. Host the file at the correct path. The file must be accessible at https://yourdomain.com/.well-known/apple-developer-merchantid-domain-association. Apple's servers will fetch this file to verify you control the domain.
5. Verify. Click the verify button in the Paystack dashboard. Paystack triggers Apple's verification. If the file is accessible, verification succeeds.

Here is how to serve the verification file in common setups:

// Express.js: serve the Apple Pay verification file
const express = require('express');
const path = require('path');
const app = express();

// Serve the .well-known directory
app.use(
  '/.well-known',
  express.static(path.join(__dirname, '.well-known'))
);

// Place the file at:
// your-project/.well-known/apple-developer-merchantid-domain-association

// Next.js: place the file in your public directory
// public/.well-known/apple-developer-merchantid-domain-association
// Next.js serves the public directory at the root automatically

Common mistakes during domain verification:

• File not served over HTTPS. The verification URL must be HTTPS. If your site does not have SSL, fix that first.
• File has the wrong content type. Some server configurations add a .txt extension or serve it with the wrong MIME type. The file should be served as-is, without modification.
• CDN or proxy stripping the path. If you use Cloudflare, Vercel, or another proxy, make sure the /.well-known/ path is not being blocked or redirected.
• Wrong domain. If your site is at www.yourapp.co.ke but you verified yourapp.co.ke, Apple Pay will not work on the www subdomain. Verify every domain variant your customers might visit.

Apple Pay works on Apple devices and Safari. Not everywhere else.

Supported:

• iPhone (iPhone 6 and later) via Safari and in-app.
• iPad (iPad Air 2, iPad mini 3, iPad Pro, and later) via Safari and in-app.
• Mac with Touch ID (MacBook Pro with Touch Bar, MacBook Air 2018+, iMac with Touch ID) via Safari.
• Mac without Touch ID can use Apple Pay in Safari by confirming on a paired iPhone or Apple Watch.
• Apple Watch for in-app payments.

Not supported:

• Any Android device.
• Chrome, Firefox, Edge, or any non-Safari browser on macOS.
• Any browser on Windows or Linux.
• Older iPhones (before iPhone 6) and iPads without Touch ID or Face ID.

This is a significant limitation in Kenya. Android dominates the smartphone market here. The iPhone user base, while growing, is a fraction of total smartphone users. This does not mean Apple Pay is useless. It means you should set your expectations accordingly. Apple Pay will not be your highest-volume payment method. But for the customers who can use it, it offers the fastest checkout experience possible.

Paystack handles device detection automatically. When you include apple_pay in the channels array, Paystack's checkout only shows the Apple Pay option to customers on compatible devices and browsers. Customers on Android or Chrome simply will not see it. You do not need to write device detection code yourself.

Enabling Apple Pay in your Paystack integration requires adding apple_pay to the channels array. That is the only code change.

Transaction Initialize (server-side):

const initializeWithApplePay = async (email, amountKes) => {
  const response = await fetch('https://api.paystack.co/transaction/initialize', {
    method: 'POST',
    headers: {
      Authorization: 'Bearer sk_live_YOUR_SECRET_KEY',
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      email: email,
      amount: amountKes * 100,
      currency: 'KES',
      channels: ['apple_pay', 'card', 'mobile_money', 'bank_transfer'],
      callback_url: 'https://yourapp.co.ke/payment/callback',
    }),
  });

  const data = await response.json();
  return data.data.authorization_url;
};

Paystack Inline (client-side popup):

const handler = PaystackPop.setup({
  key: 'pk_live_YOUR_PUBLIC_KEY',
  email: 'customer@example.com',
  amount: 500000, // KES 5,000 in cents
  currency: 'KES',
  channels: ['apple_pay', 'card', 'mobile_money', 'bank_transfer'],
  callback: function (response) {
    // Verify the transaction on your server
    fetch('/api/verify-payment', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ reference: response.reference }),
    });
  },
});
handler.openIframe();

The channels array controls which payment methods appear. By listing apple_pay first, you signal to Paystack that it should be prioritized in the display order for compatible devices. For non-Apple devices, Paystack will skip it and show the next available option.

Your webhook handler does not need any changes. Apple Pay payments arrive as a charge.success event with the same payload structure. The channel field will be apple_pay, which is useful for analytics but does not affect your processing logic.

For a customer with an iPhone and a card in Apple Wallet, the Apple Pay checkout looks like this:

1. They tap "Pay" on your checkout page (in Safari).
2. The Paystack checkout appears with Apple Pay as an option.
3. They tap the Apple Pay button.
4. An Apple Pay sheet slides up from the bottom of the screen showing: the amount (e.g., KES 5,000), the merchant name (your business name), and the card that will be charged.
5. They double-click the side button and authenticate with Face ID (or Touch ID on older models).
6. A checkmark animation confirms the payment.
7. They are redirected to your callback URL.

Total time from tap to confirmation: about 3 seconds. Compare this with typing a 16-digit card number, expiry date, and CVV, then going through 3D Secure. Or compare with M-Pesa where the customer enters their phone number, waits for the STK push, then enters their M-Pesa PIN.

For the customer, Apple Pay is the fastest option. That speed translates to higher conversion rates on your checkout page, specifically for the subset of customers who have Apple devices and cards in their wallet. Whether that subset is large enough to move your overall numbers depends on your audience.

Kenya is not San Francisco. The iPhone market share is smaller, and M-Pesa is the dominant payment method. So when does Apple Pay actually matter here?

Premium e-commerce. If you sell premium products or services (electronics, fashion, travel), your customer base likely has a higher iPhone penetration. These customers expect a polished checkout experience. Apple Pay delivers it.

International customers. If your business serves tourists, diaspora, or international clients (consulting, freelance, SaaS), many of these customers will have Apple Pay set up and prefer it over entering card details on an unfamiliar website.

Subscription services. Customers who pay monthly (streaming, software, gym memberships) appreciate the speed of Apple Pay for repeat purchases. The biometric authentication is faster than re-entering card details each time, especially if the card is not tokenized for automatic charges.

In-app purchases. If you have an iOS app, Apple Pay is the native payment experience. Users on iPhones expect it. Not offering it feels like an oversight.

B2B with corporate cards. Some Kenyan corporate buyers have Visa or Mastercard corporate cards saved in Apple Wallet. For B2B transactions, Apple Pay can be faster and more secure than manual card entry.

Apple Pay is not going to be your top payment method in Kenya. M-Pesa will hold that spot for the foreseeable future. But adding Apple Pay costs you essentially nothing (a domain verification step and adding a string to an array) and improves the experience for a segment of your paying customers. That is a good trade.

For Apple Pay to work, the customer needs a card from a bank that supports Apple Wallet. In Kenya, several banks have rolled out Apple Wallet support for their Visa and Mastercard debit and credit cards.

The list of supporting banks grows over time. Major banks like Equity, KCB, NCBA, Absa, Standard Chartered, and Stanbic have introduced or are in the process of introducing Apple Wallet support. Check with individual banks for their current status, as rollouts can be phased (e.g., credit cards first, then debit cards).

International card issuers (Revolut, Wise, N26) that are commonly used by diaspora and international customers also support Apple Wallet, which means those customers can pay Kenyan merchants with Apple Pay even if their card was not issued in Kenya.

A customer who has a Kenyan Visa debit card but whose bank does not yet support Apple Wallet cannot use Apple Pay. They fall back to the regular card entry flow or M-Pesa. Your checkout should always have fallback options. Never make Apple Pay the only payment method.

Apple Pay is arguably the most secure card payment method available to your customers. Here is why:

• No card number transmitted. Apple Pay uses a device-specific token and a one-time payment code. Your server never sees the actual card number. Paystack never sees the actual card number. Only the card network (Visa/Mastercard) and the issuing bank can resolve the token back to a card.
• Biometric authentication. Every payment requires Face ID, Touch ID, or a device passcode. A stolen iPhone cannot be used for Apple Pay without the owner's biometrics.
• No card data stored on your server. Since you never receive card numbers, you have no card data to protect. This simplifies your PCI DSS obligations.
• No chargebacks from lost/stolen cards. Because Apple Pay requires biometric authentication for every transaction, fraud from lost or stolen cards is extremely rare. This does not eliminate chargebacks entirely (a customer can still dispute a legitimate charge), but it removes the most common fraud vector.

For your business, this means lower fraud risk on Apple Pay transactions compared to manually-entered card transactions. If you operate in a sector with high card fraud rates, Apple Pay provides a cleaner payment channel.

Testing Apple Pay requires an Apple device. You cannot test it on Android or in a desktop browser other than Safari on a Mac with Touch ID.

Testing steps:

1. Use your Paystack test key. Test mode transactions are not charged to the card.
2. Add a test card to Apple Wallet. Paystack documentation may specify test card numbers that work with Apple Pay in their sandbox. If not, you can use a real card in test mode; Paystack will not actually charge it.
3. Verify your staging domain. If your staging environment is at staging.yourapp.co.ke, verify that domain separately in the Paystack dashboard. Apple Pay domain verification is per-domain.
4. Open your checkout on an iPhone in Safari. Check that the Apple Pay button appears. Tap it, authenticate with Face ID or Touch ID, and verify that your webhook receives the test payment event.
5. Test on a non-Apple device. Confirm that the Apple Pay option does not appear. Customers on Android should see M-Pesa, card, and Pesalink but not Apple Pay.

If you do not have an iPhone for testing, ask a colleague or friend with one to help. You cannot fake Apple Pay in a simulator or emulator for payment testing. The real device is required because Apple Pay depends on the Secure Element chip in the phone.

Apple Pay is one piece of a multi-method checkout. Here is where to go from here:

• Paystack in Kenya: M-Pesa, Pesalink, and the Daraja Question for the full payment method landscape.
• Accepting M-Pesa Payments Through Paystack Checkout for the payment method that will likely handle most of your volume.
• Pay with Pesalink on Paystack for another payment method to add alongside Apple Pay and M-Pesa.
• Building a Kenyan E-Commerce Checkout for a complete multi-method checkout implementation.
• Airtel Money Through Paystack in Kenya for covering the second-largest mobile money network.

If you are building payment integrations for the Kenyan market, the McTaba M-Pesa/Daraja micro-course teaches you to build production-grade payment systems. Cards, mobile money, Apple Pay, webhooks, reconciliation. The full picture, not just one piece.