Apple & Google Wallet Platform
Secure digital pass creation, issuance, and lifecycle management across both ecosystems.
01 — The problem
The product needed to put a live, updatable credential in a user's phone — on both Apple Wallet and Google Wallet — tied to transactional state that changes after issuance. These two platforms share a goal and almost nothing else: different signing models, different update mechanisms, different failure modes, and unforgiving certificate requirements on one side.
02 — Constraints
Apple passes are cryptographically signed bundles; a malformed manifest is a silent failure.
Signing certificates expire — rotation cannot mean reissuing every pass by hand.
Passes must reflect transactional state changes after they're already in the wallet.
Private keys never leave managed secret storage.
One product surface, two fundamentally different platform contracts.
03 — Architecture
Platform-agnostic pass domain
A single internal pass model describes what a credential means; per-platform adapters translate it into an Apple .pkpass bundle or a Google Wallet object. Product logic is written once against the domain model and never against a vendor payload.
Signing pipeline with managed keys
Certificate material lives in managed secret storage and is loaded into the signing path at runtime — never committed, never on disk. Manifest generation and signing are a deterministic, testable step, so a bad bundle fails in CI rather than in a user's wallet.
Push-driven pass updates
Registered devices are tracked per pass. When transactional state changes, the platform pushes an update notification and serves the regenerated pass on the follow-up fetch — so the credential in the user's pocket stays truthful without any app interaction.
Issuance as an auditable event stream
Creation, registration, update, and revocation are recorded as events. Support can answer 'what did this user's pass look like on Tuesday' without guessing, and revocation is a state transition rather than a deletion.
04 — Outcome
One issuance platform serving both Apple Wallet and Google Wallet from a shared domain model.
Certificate rotation became an operational task, not a migration.
Passes stay in sync with transactional state via push updates.
Full audit trail across the pass lifecycle for support and compliance.