Create a Wallet Merchant Session

Validates a wallet merchant session and returns an opaque merchantSession to hand back to the wallet on the customer’s device.

Required for Apple Pay when you render the wallet button yourself and submit the token from your own server. Google Pay has no equivalent step, and neither the hosted checkout nor the default (non-manual) SDK mode needs this call — both make it for you.

You supply only the session and the validationUrl the wallet gave you. The merchant identifier, payment domain and certificates are resolved by CrissCross from sessionId, so none of them are ever exposed to you or to the browser. See the Server Integration guide.

Validates a wallet merchant session and returns an opaque `merchantSession` to hand back to the wallet on the customer's device. Required for **Apple Pay** when you render the wallet button yourself and submit the token from your own server. Google Pay has no equivalent step, and neither the hosted checkout nor the default (non-manual) SDK mode needs this call — both make it for you. You supply only the session and the `validationUrl` the wallet gave you. The merchant identifier, payment domain and certificates are resolved by CrissCross from `sessionId`, so none of them are ever exposed to you or to the browser. See the [Server Integration guide](/wallets-server-integration).

Request

This endpoint expects an object.

sessionIdstringRequiredformat: "uuid"

The checkout session the wallet payment belongs to.

providerenumRequired

The wallet requesting validation. Only apple-pay requires a merchant session.

validationUrlstringRequiredformat: "uri"

The validation URL supplied by the wallet on the customer’s device. Forward it unaltered; it is issued per wallet interaction.

CrissCross validates this value before using it: it must be an HTTPS URL on an Apple Pay validation host, and anything else is rejected with 422 rather than requested. Never construct or rewrite it — pass through exactly what the wallet gave you.

Response

Merchant session created. Return merchantSession to the browser unaltered, as JSON — it is validated as an opaque whole and is single-use and short-lived. Do not cache, re-serialise or log it.

merchantSessionmap from strings to any

Opaque merchant session to return to the browser unaltered. Treat it as a payment credential for as long as it is valid.

Errors

400

Bad Request Error

401

Unauthorized Error

404

Not Found Error

422

Unprocessable Entity Error