> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wegive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Apple Pay through VGS

> Connect your nonprofit's Apple Merchant ID, upload certificates, verify donation domains, and enable one-time Apple Pay in Donor Portal V2.

Let donors authorize a one-time gift with Apple Pay on your WeGive checkout. Your organization owns the Apple account and merchant setup. WeGive connects it to VGS, which secures the payment details, and your approved payment processor completes the charge.

<Note>
  This setup is available by arrangement with WeGive for **Donor Portal V2**, using **Chase Orbital** or an approved, enabled **Finix** connection. It supports **one-time USD payments**. Recurring donations and Portal V1 are outside this setup. Organizations using Apple Pay through Stripe or Braintree should continue using their existing provider's setup.
</Note>

## Your setup at a glance

<Steps>
  <Step title="Prepare your Apple account">
    Confirm nonprofit eligibility, create or select your Merchant ID, and accept any required Apple agreements.
  </Step>

  <Step title="Connect two certificates">
    Download each certificate request from WeGive, have Apple sign it, and upload the matching certificate to WeGive.
  </Step>

  <Step title="Verify every donation domain">
    Publish Apple's association file through WeGive, complete verification in Apple Developer, and confirm that result in WeGive.
  </Step>

  <Step title="Enable and test">
    Save VGS as your provider, enable Apple Pay on your checkout, and complete an agreed test donation.
  </Step>
</Steps>

<CardGroup cols={2}>
  <Card title="Test and troubleshoot" icon="circle-check" href="/external/support/settings/apple-pay-vgs-testing">
    Understand test organizations, check button visibility, and verify a complete donation.
  </Card>

  <Card title="Renew and maintain" icon="refresh-cw" href="/external/support/settings/apple-pay-vgs-renewal">
    Keep certificates, contacts, and donation domains current.
  </Card>
</CardGroup>

## Before you start

| You need | What to check |
| - | - |
| WeGive setup access | Ask WeGive to enable Apple Pay setup for your organization. You also need permission to manage its payment settings. |
| An eligible processor | Confirm Chase Orbital Apple Pay enablement, or Finix approval and WeGive activation, before launch. Payrix / Worldpay is not available through this customer setup. |
| Your organization's Apple Developer account | An Account Holder or Admin must be able to manage Merchant IDs, certificates, and domains. Keep the Account Holder available to accept agreements. |
| Apple's nonprofit eligibility | Review [Apple Pay for nonprofits](https://developer.apple.com/apple-pay/nonprofits/) and complete the applicable requirements. |
| A Portal V2 custom domain | It must already be assigned to this organization in WeGive and work over HTTPS. Include every hostname where donors will pay. |
| A renewal contact | Use an email inbox your organization monitors for certificate reminders. |

If you have a separate test or UAT organization in WeGive, open that organization before starting. Its setup access and configuration must be arranged separately.

<Warning>
  **Already accepting Apple Pay on this domain?** Coordinate the change with WeGive before publishing a new association file. Publishing changes the file used for domain verification and can interrupt an existing Stripe or Braintree setup. Prepare your certificates first, then schedule domain publication and provider activation together.
</Warning>

## 1. Prepare your Merchant ID

Open [Apple Developer → Certificates, Identifiers & Profiles](https://developer.apple.com/account/resources/identifiers/list/merchant). Under **Identifiers**, change the filter from **App IDs** to **Merchant IDs**, if needed.

Select the Merchant ID intended for this WeGive setup. If you need a new one, follow [Apple's Merchant ID registration instructions](https://developer.apple.com/help/account/capabilities/configure-apple-pay/). A merchant identifier looks like `merchant.org.example.donations`.

Check for an agreement banner. Your Account Holder may need to accept the **Apple Pay Platform Web Merchant Terms and Conditions** before Merchant Identity certificates and Merchant Domains become available. Being able to create a Payment Processing certificate does not mean those other controls are unlocked.

Keep this Merchant ID open; both certificates and all domain registrations below belong to it.

## 2. Start setup in WeGive

1. Open **Settings → Payments → Apple Pay** in the correct organization.
2. Select **VGS** in the provider menu to reveal the setup form.
3. Enter your exact Apple merchant identifier and renewal email.
4. Confirm that your nonprofit meets Apple's donation requirements.
5. Select **Configure Apple Pay**.

Choosing VGS to prepare the form does not save a provider change. The final activation step comes after validation.

<Note>
  The eligibility checkbox records your confirmation; it does not apply for Apple's approval. The merchant identifier is fixed after setup starts. Contact WeGive if you entered the wrong one.
</Note>

## 3. Create and upload both certificates

A **certificate signing request (CSR)** is a file WeGive creates for Apple to sign. Use the request from the matching WeGive certificate card.

```mermaid theme={null}
flowchart LR
    A[WeGive: download CSR] --> B[Apple: sign the request]
    B --> C[Apple: download certificate]
    C --> D[WeGive: upload certificate]
```

| Certificate card | Its job | Completed state in WeGive |
| - | - | - |
| Merchant Identity | Lets WeGive validate your checkout with Apple. | Active |
| Payment Processing | Lets VGS decrypt the payment authorized in Wallet. | Installed, with Connection status: Ready |

### Merchant Identity certificate

1. In WeGive's **Merchant Identity** card, select **Download certificate request**.
2. In Apple Developer, open the same Merchant ID. Under **Apple Pay Merchant Identity Certificate**, select **Create Certificate**.
3. Upload the **identity CSR** downloaded from WeGive.
4. Download Apple's signed `.cer` file.
5. Return to WeGive's **Merchant Identity** card, choose the signed certificate, and select **Upload signed certificate**.
6. Confirm the certificate becomes **Active**.

### Payment Processing certificate

1. In WeGive's **Payment Processing** card, select **Download certificate request**.
2. In Apple Developer, under **Apple Pay Payment Processing Certificate**, select **Create Certificate**.
3. Upload the **processing CSR** downloaded from WeGive.
4. Download Apple's signed `.cer` file.
5. Return to WeGive's **Payment Processing** card, choose that certificate, and select **Upload signed certificate**.
6. Wait for installation to finish and **Connection status: Ready**. If setup reports an error, follow its instructions or use **Retry setup** when offered.

<Tip>
  Keep the two files paired with their certificate cards. Selecting a file does not upload it: use **Upload signed certificate** to finish each step.
</Tip>

WeGive validates the uploaded certificates and sets up the VGS connection automatically. You do not need a VGS account, service key, or route configuration file.

<Warning>
  Use the CSRs generated by WeGive for this organization. A certificate created from a different provider's CSR will not match. Installing the `.cer` in your Mac's Keychain does not complete this setup. Upload the signed public certificate to WeGive; do not upload private keys or share Apple account passwords.
</Warning>

Apple's reference guides cover [web merchant identity](https://developer.apple.com/help/account/capabilities/configure-apple-pay-on-the-web/) and [payment processing certificates](https://developer.apple.com/help/account/capabilities/configure-apple-pay/).

## 4. Verify each donation domain

WeGive lists the custom domains assigned to this organization's Donor Portal V2. Repeat these steps for **each exact hostname**. For example, `giving.example.org` and `giving-stg.example.org` need separate verification; multiple checkout pages on `giving.example.org` share that hostname.

<Steps>
  <Step title="Add the domain in Apple Developer">
    Under your Merchant ID, find **Merchant Domains**, select **Add Domain**, and enter the hostname without `https://` or a checkout path. Download the association file Apple provides for that domain.
  </Step>

  <Step title="Publish it from the matching WeGive domain row">
    Select **Choose association file**, choose Apple's file, and check **Publish this file on this domain.** Select **Publish file**. For an existing upload, the action is **Replace file**.

    A descriptive download filename is fine. Upload the original contents to the correct domain row; do not edit or re-encode the file.
  </Step>

  <Step title="Check public file delivery">
    Select **Check domain**, then **View public association file**. The file must open directly over HTTPS, without a sign-in page or redirect.

    WeGive serves it at both of these paths on your domain:

    ```text theme={null}
    /.well-known/apple-developer-merchantid-domain-association
    /.well-known/apple-developer-merchantid-domain-association.txt
    ```

    Encoded text or a file download is expected. An error message or your donation homepage is not a successful file response.
  </Step>

  <Step title="Complete verification in Apple">
    Return to the Merchant Domains section in Apple Developer and select **Verify**. Wait for Apple to report that the domain is verified. See [Apple's domain verification instructions](https://developer.apple.com/help/account/capabilities/configure-apple-pay-on-the-web/).
  </Step>

  <Step title="Confirm Apple's result in WeGive">
    Check **Apple Developer shows this domain as verified for our merchant ID.** Then select **Confirm Apple verification**. Confirm that WeGive's verified-domain count increases.
  </Step>
</Steps>

### What the two checks mean

| Action | What it confirms |
| - | - |
| **Check domain** in WeGive | The public URL serves the uploaded association file correctly. |
| **Verify** in Apple Developer | Apple accepts the domain for your Merchant ID. |
| **Confirm Apple verification** in WeGive | You attest that Apple has completed verification. This records that result in WeGive. |

Confirming verification does not enable Apple Pay by itself. Replacing a file clears its verification record, so repeat the checks after replacement.

## 5. Enable Apple Pay and test your checkout

1. Resolve every remaining setup requirement.
2. Confirm the certificates are active/installed and the intended checkout domain is verified.
3. Select **Save provider** to activate VGS.
4. Confirm **Apple Pay** is enabled in the settings for each checkout you plan to launch.
5. Follow the [testing guide](/external/support/settings/apple-pay-vgs-testing) and verify a complete one-time donation before launch.

<Note>
  If the page says **Ready**, VGS is already selected, and **Save provider** is disabled while Apple Pay remains unavailable, contact WeGive to confirm activation. Your certificates and domain files do not need to be recreated to resolve that state.
</Note>

At least one verified domain is required for activation. That does not verify the other domains in the list: each checkout hostname must complete its own steps.

### Launch checklist

* [ ] WeGive has confirmed your processor connection is eligible.
* [ ] Both certificates belong to the intended Merchant ID and show completed states.
* [ ] Every launch hostname is verified in Apple Developer and confirmed in WeGive.
* [ ] VGS is saved and activated as the organization's Apple Pay provider.
* [ ] Apple Pay is enabled on the intended Portal V2 checkouts.
* [ ] A complete one-time donation has been verified for the intended environment.
* [ ] Your team knows who monitors certificate reminders and owns renewal.

<CardGroup cols={2}>
  <Card title="Next: test your setup" icon="circle-check" href="/external/support/settings/apple-pay-vgs-testing">
    Check single-page and stepper checkout, guest donations, and payment results.
  </Card>

  <Card title="Plan for renewal" icon="calendar" href="/external/support/settings/apple-pay-vgs-renewal">
    Maintain the certificates and domains that keep Apple Pay available.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.