> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wegive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Renew and maintain Apple Pay through VGS

> Renew Apple Pay certificates, add donation domains, and keep your organization's setup working.

Your organization manages its Apple account, certificate signing, and domain verification. WeGive installs validated certificates and manages the connection to VGS.

Open **Settings → Payments → Apple Pay** to check certificate expiry dates, connection status, and verified domains. Keep the renewal email current and monitor Apple Developer notices as well.

<Warning>
  Renew before expiration. Do not revoke an existing certificate until its replacement is installed and the transition is confirmed. Retaining an old certificate in WeGive cannot make an expired or revoked certificate valid in Apple.
</Warning>

## Renew the Merchant Identity certificate

<Steps>
  <Step title="Create the renewal request in WeGive">
    In the **Merchant Identity** card, select **Start renewal**, then download the new certificate request. Use this new CSR for the renewal.
  </Step>

  <Step title="Have Apple sign the request">
    Open the same Merchant ID in Apple Developer. Create a new **Apple Pay Merchant Identity Certificate** using the new identity CSR, then download the signed `.cer`.
  </Step>

  <Step title="Upload and verify">
    Choose the signed certificate in WeGive's **Merchant Identity** card and select **Upload signed certificate**. Confirm it becomes **Active** with the new expiry date. WeGive keeps the current identity selected until the replacement passes validation.
  </Step>
</Steps>

## Renew the Payment Processing certificate

The installation order matters because the payment token must be encrypted for a key the VGS connection can use.

<Steps>
  <Step title="Create and sign the new processing request">
    Select **Start renewal** in WeGive's **Payment Processing** card and download the CSR. In Apple Developer, use it to create a new **Apple Pay Payment Processing Certificate** under the same Merchant ID. Download the signed `.cer`.
  </Step>

  <Step title="Install the replacement in WeGive">
    Choose the new certificate in the **Payment Processing** card and select **Upload signed certificate**. Wait for **Installed** and **Connection status: Ready**. Keep the old certificate available during this transition.
  </Step>

  <Step title="Activate the replacement in Apple">
    Once installation is confirmed, complete Apple's activation step for the replacement certificate. Follow [Apple's certificate update guidance](https://developer.apple.com/documentation/technotes/tn3206-updating-apple-pay-certificates).
  </Step>

  <Step title="Verify checkout">
    Complete an agreed test using the [testing guide](/external/support/settings/apple-pay-vgs-testing). Confirm the donation result for the intended environment before treating renewal as complete.
  </Step>
</Steps>

WeGive supports two valid processing certificates during the transition and updates the existing VGS connection. If another renewal is blocked because two valid processing certificates already exist, contact WeGive before removing either one.

A rejected upload or failed installation does not complete renewal. Resolve the displayed error or contact WeGive; do not activate the new processing certificate in Apple while installation is incomplete.

## Add or replace a donation domain

| Change | What to do |
| - | - |
| Add a new hostname | Have it assigned to this organization's Portal V2. Register that exact hostname under your Merchant ID and complete the [domain verification steps](/external/support/settings/apple-pay-vgs-setup#4-verify-each-donation-domain). |
| Add another checkout on an already verified hostname | Enable Apple Pay for the checkout and test its processor and payment settings. A new checkout path does not require a new hostname registration. |
| Replace an association file | Publish the replacement on the correct domain row, check file delivery, verify in Apple, then confirm verification in WeGive again. |
| Move from a staging domain to a live domain | Verify the live hostname separately and complete the launch checklist there. Staging verification does not transfer. |
| Apple requests re-verification | Follow Apple's notice and repeat verification. A successful previous check in WeGive does not extend Apple's registration. |

Renewal and domain updates do not automatically select VGS as your provider. Check activation and checkout settings after the work is complete.

## Change providers or Merchant IDs

Coordinate these changes with WeGive before publishing new files or revoking certificates:

* Switching Apple Pay between VGS, Stripe, and Braintree.
* Changing the Merchant ID associated with the configuration.
* Moving configuration between organization records.
* Replacing credentials after a suspected compromise or urgent revocation.

Provider changes can also change the public domain-association file. Plan the file change, provider activation, and verification together so donors are not left with an incomplete setup.

## Keep an ownership record

Keep this information with your team's operating instructions:

| Item | Record |
| - | - |
| Apple account owner | Who manages the Developer membership and accepts agreements. |
| Merchant ID | The identifier used by this WeGive configuration. |
| Renewal owner | Who monitors reminders and performs each certificate renewal. |
| Certificate dates | The displayed expiry date for each certificate type. |
| Donation domains | Every verified staging and live hostname, with its WeGive organization. |
| Last completed test | Date, environment, checkout URL, and donation reference. |

This record does not need private keys, Apple passwords, or payment data.

<CardGroup cols={2}>
  <Card title="Full setup guide" icon="list-check" href="/external/support/settings/apple-pay-vgs-setup">
    Review the certificate and domain workflow.
  </Card>

  <Card title="Testing and troubleshooting" icon="circle-check" href="/external/support/settings/apple-pay-vgs-testing">
    Verify the transition and diagnose incomplete setup.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.