> ## Documentation Index > Fetch the complete documentation index at: https://docs.imprint.co/llms.txt > Use this file to discover all available pages before exploring further. # Add a payment method to a device wallet > Provisions the payment method into the device wallet named by the `wallet` path parameter, returning the encrypted payload the platform wallet SDK needs to finish adding the card. Only `apple_pay` is supported today. Your app must obtain the PassKit handshake before calling this endpoint. The `certificates`, `nonce`, and `nonce_signature` values come from the `PKAddPaymentPassViewControllerDelegate` callback and must be Base64-encoded — PassKit supplies them as `Data`, not strings. The returned payload is single-use. Hand it straight to the wallet SDK; do not cache, log, or persist it. See the [Add to Wallet guide](https://docs.imprint.co/add-to-wallet) for the full integration flow. **Required scope:** `CARD_WRITE` ## OpenAPI ````yaml /api-reference/openapi.yaml post /v2/payment_methods/{payment_method_id}/provision/{wallet} openapi: 3.1.0 info: title: Public Imprint API version: '2.0' servers: - url: https://dev.sbx.imprint.co description: Imprint public api sandbox security: - basicAuth: [] - bearerAuth: [] paths: /v2/payment_methods/{payment_method_id}/provision/{wallet}: post: tags: - Payment Methods summary: Add a payment method to a device wallet description: > Provisions the payment method into the device wallet named by the `wallet` path parameter, returning the encrypted payload the platform wallet SDK needs to finish adding the card. Only `apple_pay` is supported today. Your app must obtain the PassKit handshake before calling this endpoint. The `certificates`, `nonce`, and `nonce_signature` values come from the `PKAddPaymentPassViewControllerDelegate` callback and must be Base64-encoded — PassKit supplies them as `Data`, not strings. The returned payload is single-use. Hand it straight to the wallet SDK; do not cache, log, or persist it. See the [Add to Wallet guide](https://docs.imprint.co/add-to-wallet) for the full integration flow. **Required scope:** `CARD_WRITE` operationId: provisionPaymentMethod parameters: - name: payment_method_id in: path required: true description: The unique identifier of the payment method schema: type: string example: 9ED4FE47-8E9C-48E9-BBEF-094DF1789012 - name: wallet in: path required: true description: The target device wallet. schema: type: string enum: - apple_pay example: apple_pay requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ApplePayProvisionRequest' responses: '200': description: Provisioning payload for `PKAddPaymentPassRequest`. content: application/json: schema: $ref: '#/components/schemas/ApplePayProvisionResponse' '400': description: Malformed body, failed field validation, or unsupported wallet. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '403': description: The API key does not have card write access. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '404': description: The payment method does not exist or is not owned by the caller. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '409': description: Already provisioned to this wallet on this device. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' '422': description: > Well-formed but not actionable — an ineligible device, or a PassKit nonce that has gone stale. content: application/json: schema: $ref: '#/components/schemas/ProvisioningError' components: schemas: ApplePayProvisionRequest: type: object required: - certificates - nonce - nonce_signature additionalProperties: false properties: certificates: type: array minItems: 1 description: > The Base64-encoded DER certificate chain from the PassKit delegate (`generateRequestWithCertificateChain:`), leaf first, then intermediate. PassKit supplies these as `[Data]` — Base64-encode each element. items: type: string example: - MIIEgjCCBCmgAwIBAgI - MIIDxTCCA2ugAwIBAgI nonce: type: string description: The Base64-encoded nonce from PassKit. example: 3vT9Kw== nonce_signature: type: string description: The Base64-encoded nonce signature from PassKit. example: R0hJSktMTU5PUFE= ApplePayProvisionResponse: type: object required: - wallet - provisioning_payload properties: wallet: type: string enum: - apple_pay description: The wallet the payment method was provisioned into. provisioning_payload: $ref: '#/components/schemas/ApplePayPayload' ProvisioningError: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string description: A machine-readable code identifying the failure. enum: - invalid_request - wallet_unsupported - permission_denied - payment_method_not_found - already_provisioned - device_ineligible example: device_ineligible message: type: string description: A message describing the cause of the error. example: this device cannot accept this card details: type: object additionalProperties: true description: Additional context about the failure, when available. ApplePayPayload: type: object required: - activation_data - encrypted_pass_data - ephemeral_public_key description: > Maps field-for-field onto `PKAddPaymentPassRequest`. All values are Base64-encoded. properties: activation_data: type: string description: Assign to `PKAddPaymentPassRequest.activationData`. encrypted_pass_data: type: string description: Assign to `PKAddPaymentPassRequest.encryptedPassData`. ephemeral_public_key: type: string description: > Assign to `PKAddPaymentPassRequest.ephemeralPublicKey`. Imprint uses elliptic-curve key exchange, so this is always the key field — the RSA `wrappedKey` variant is not used. securitySchemes: basicAuth: type: http scheme: basic description: >- Basic HTTP authentication. Allowed headers-- Authorization: Basic bearerAuth: bearerFormat: auth-scheme description: >- Bearer HTTP authentication. Allowed headers-- Authorization: Bearer scheme: bearer type: http ````