> ## Documentation Index > Fetch the complete documentation index at: https://docs.imprint.co/llms.txt > Use this file to discover all available pages before exploring further. # Add a payment method to a device wallet > Provisions the payment method into the device wallet named by the `wallet` path parameter, returning the encrypted payload the platform wallet SDK needs to finish adding the card. `apple_pay` expects the PassKit handshake; `google_pay` expects the Google wallet and device identifiers. For `apple_pay`, your app must obtain the PassKit handshake before calling this endpoint. The `certificates`, `nonce`, and `nonce_signature` values come from the `PKAddPaymentPassViewControllerDelegate` callback and must be Base64-encoded — PassKit supplies them as `Data`, not strings. For `google_pay`, send the active wallet ID and stable device ID from the TapAndPay client. The returned payload is single-use. Hand it straight to the wallet SDK; do not cache, log, or persist it. See the [Add to Wallet guide](https://docs.imprint.co/add-to-wallet) for the full integration flow. **Required scope:** `CARD_WRITE` ## OpenAPI ````yaml /api-reference/2025-05-05/openapi.yaml post /v2/payment_methods/{payment_method_id}/provision/{wallet} openapi: 3.1.0 info: title: Public Imprint API version: '2.0' servers: - url: https://dev.sbx.imprint.co description: Imprint public api sandbox security: - basicAuth: [] - bearerAuth: [] paths: /v2/payment_methods/{payment_method_id}/provision/{wallet}: post: tags: - Payment Methods summary: Add a payment method to a device wallet description: > Provisions the payment method into the device wallet named by the `wallet` path parameter, returning the encrypted payload the platform wallet SDK needs to finish adding the card. `apple_pay` expects the PassKit handshake; `google_pay` expects the Google wallet and device identifiers. For `apple_pay`, your app must obtain the PassKit handshake before calling this endpoint. The `certificates`, `nonce`, and `nonce_signature` values come from the `PKAddPaymentPassViewControllerDelegate` callback and must be Base64-encoded — PassKit supplies them as `Data`, not strings. For `google_pay`, send the active wallet ID and stable device ID from the TapAndPay client. The returned payload is single-use. Hand it straight to the wallet SDK; do not cache, log, or persist it. See the [Add to Wallet guide](https://docs.imprint.co/add-to-wallet) for the full integration flow. **Required scope:** `CARD_WRITE` operationId: provisionPaymentMethod parameters: - name: payment_method_id in: path required: true description: The unique identifier of the payment method schema: type: string example: 9ED4FE47-8E9C-48E9-BBEF-094DF1789012 - name: wallet in: path required: true description: The target device wallet. schema: type: string enum: - apple_pay - google_pay example: apple_pay requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ProvisionPaymentMethodRequest' responses: '200': description: Provisioning payload for the selected wallet SDK. content: application/json: schema: $ref: '#/components/schemas/ProvisionPaymentMethodResponse' '400': description: Malformed body, failed field validation, or unsupported wallet. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '403': description: The API key does not have card write access. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '404': description: The payment method does not exist or is not owned by the caller. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '409': description: Already provisioned to this wallet on this device. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '422': description: > Well-formed but not actionable — an ineligible device, or a PassKit nonce that has gone stale. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' components: schemas: ProvisionPaymentMethodRequest: description: > Select the request body that matches the `wallet` path value: Option 1 is Apple Pay (`apple_pay`) and Option 2 is Google Pay (`google_pay`). Fields from the two options cannot be mixed. oneOf: - $ref: '#/components/schemas/ApplePayProvisionRequest' - $ref: '#/components/schemas/GooglePayProvisionRequest' ProvisionPaymentMethodResponse: description: > The response shape matches the selected wallet: Option 1 is Apple Pay (`apple_pay`) and Option 2 is Google Pay (`google_pay`). oneOf: - $ref: '#/components/schemas/ApplePayProvisionResponse' - $ref: '#/components/schemas/GooglePayProvisionResponse' ProvisioningError: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string description: A machine-readable code identifying the failure. enum: - invalid_request - wallet_unsupported - permission_denied - payment_method_not_found - already_provisioned - device_ineligible example: device_ineligible message: type: string description: A message describing the cause of the error. example: this device cannot accept this card details: type: object additionalProperties: true description: Additional context about the failure, when available. ApplePayProvisionRequest: title: Apple Pay (apple_pay) type: object required: - certificates - nonce - nonce_signature additionalProperties: false properties: certificates: type: array minItems: 1 description: > The Base64-encoded DER certificate chain from the PassKit delegate (`generateRequestWithCertificateChain:`), leaf first, then intermediate. PassKit supplies these as `[Data]` — Base64-encode each element. items: type: string example: - MIIEgjCCBCmgAwIBAgI - MIIDxTCCA2ugAwIBAgI nonce: type: string description: The Base64-encoded nonce from PassKit. example: 3vT9Kw== nonce_signature: type: string description: The Base64-encoded nonce signature from PassKit. example: R0hJSktMTU5PUFE= GooglePayProvisionRequest: title: Google Pay (google_pay) type: object required: - wallet_id - device_id additionalProperties: false properties: wallet_id: type: string minLength: 1 description: The device-scoped Google Pay wallet identifier. device_id: type: string minLength: 1 description: The Android device identifier that will receive the token. ApplePayProvisionResponse: title: Apple Pay (apple_pay) type: object required: - wallet - provisioning_payload properties: wallet: type: string enum: - apple_pay description: The wallet the payment method was provisioned into. provisioning_payload: $ref: '#/components/schemas/ApplePayPayload' GooglePayProvisionResponse: title: Google Pay (google_pay) type: object required: - wallet - provisioning_payload properties: wallet: type: string enum: - google_pay description: The wallet the payment method was provisioned into. provisioning_payload: $ref: '#/components/schemas/GooglePayPayload' ApplePayPayload: type: object required: - activation_data - encrypted_pass_data - ephemeral_public_key description: > Maps field-for-field onto `PKAddPaymentPassRequest`. All values are Base64-encoded. properties: activation_data: type: string description: Assign to `PKAddPaymentPassRequest.activationData`. encrypted_pass_data: type: string description: Assign to `PKAddPaymentPassRequest.encryptedPassData`. ephemeral_public_key: type: string description: > Assign to `PKAddPaymentPassRequest.ephemeralPublicKey`. Imprint uses elliptic-curve key exchange, so this is always the key field — the RSA `wrappedKey` variant is not used. GooglePayPayload: type: object required: - opaque_payment_card - network - wallet_type description: Values passed to the Google Pay push-tokenization SDK. properties: opaque_payment_card: type: string description: The opaque payment card returned by the card processor. network: type: string description: The card network identifier returned by the card processor. wallet_type: type: string enum: - GOOGLE_PAY description: The processor wallet type used for provisioning. securitySchemes: basicAuth: type: http scheme: basic description: >- Basic HTTP authentication. Allowed headers-- Authorization: Basic bearerAuth: bearerFormat: auth-scheme description: >- Bearer HTTP authentication. Allowed headers-- Authorization: Bearer scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.