Apple Wallet

Build an Apple Wallet pass with your contact info and a QR code back to your page. The pass is private: you download it from Settings → Wallet and share it yourself (AirDrop, Messages, email). There is no button for visitors on your public page, and no public download link. Visitors save your contact details with the Save vCard button instead.

Prerequisites

Before you start, make sure you have:

• A paid Apple Developer Program membership ($99/year) at developer.apple.com
• A registered Pass Type Identifier
• A signing certificate and the Apple WWDR intermediate certificate

Setup Guide

1. Register a Pass Type ID

1. Log in to developer.apple.com.
2. Go to Certificates, Identifiers & Profiles > Identifiers.
3. Click + and select Pass Type IDs.
4. Enter a description (e.g., "LinkDen Business Card") and an identifier (e.g., pass.com.yourdomain.linkden).
5. Click Register.

2. Create a Signing Certificate

1. In the Apple Developer portal, go to Certificates.
2. Click + and select Pass Type ID Certificate.
3. Choose the Pass Type ID you just created.
4. Follow the instructions to generate a CSR using Keychain Access on macOS.
5. Upload the CSR and download the certificate.
6. Double-click the .cer file to install it in Keychain Access.

3. Export the Certificate and Key

1. Open Keychain Access on macOS.
2. Find the pass certificate (it shows your Pass Type ID).
3. Expand it to see the private key.
4. Select both, right-click, and choose Export 2 items.
5. Save as .p12 with a passphrase.

4. Extract PEM Files

LinkDen does not read .p12 bundles, so split it into a certificate and an unencrypted RSA key:

# Download the Apple WWDR intermediate certificate
curl -O https://www.apple.com/certificateauthority/AppleWWDRCAG4.cer

# Extract the signer certificate
openssl pkcs12 -in pass.p12 -clcerts -nokeys -out signer_cert.pem

# Extract the signer private key, unencrypted (-nodes)
openssl pkcs12 -in pass.p12 -nocerts -nodes -out signer_key.pem

Keeping the key encrypted? Drop -nodes, and set WALLET_SIGNER_KEY_PASSPHRASE to the passphrase you choose. A wrong passphrase shows up as "Unable to load wallet signer key (wrong passphrase?)" in the API logs.

5. Add the Keys

Pick one of these (a key saved in the admin overrides the environment variable):

In the admin (easiest): Settings → Wallet → Signing keys. Upload signer_cert.pem, signer_key.pem and AppleWWDRCAG4.cer (or paste PEM text). Each file is checked before it is saved, and an unusable one (an EC key, a .p12, the wrong file) is refused with a message. Clear saved removes a saved key so the environment value applies again.

As environment variables / GitHub secrets: one line each, so base64-encode the files:

base64 -i signer_cert.pem | tr -d '\n' > signer_cert_base64.txt
base64 -i signer_key.pem | tr -d '\n' > signer_key_base64.txt
base64 -i AppleWWDRCAG4.cer | tr -d '\n' > wwdr_base64.txt

Tip: The Signing Status panel shows each item as ready only when it is set and loadable, so "Ready" means the pass can really be signed.

6. Configure in Admin

Go to /admin/settings/wallet, turn on Downloads enabled in the header, and fill in the settings:

Identity:

• Team ID -- Your Apple Developer team identifier.
• Pass Type ID -- The identifier you registered (e.g., pass.com.yourdomain.linkden).
• Organization Name -- Name shown on the pass.
• Pass Description -- Brief description of the pass.

Appearance:

• Background Color -- Hex color for the pass background.
• Foreground Color -- Hex color for the pass text.
• Label Color -- Hex color for field labels.
• Logo URL -- Logo image displayed on the pass.
• Custom QR URL -- Optional custom URL for the QR code.

Context-aware (optional): a relevant date and up to 10 locations make Wallet surface the pass on the Lock Screen at the right time and place.

Pass Preview

The admin page includes a live preview showing how your pass will look with your current colors, logo, and content. Field sections are capped the same way in the preview and the real pass.

Downloading and Sharing

Click Download pass in the Settings → Wallet header. You must be signed in; the download is rate limited and never cached. If downloads are switched off the link returns 404, and if signing material is missing or unusable it returns 503 ("Wallet pass is not available yet."); the API logs say why. Open the .pkpass on an iPhone or Mac to add it to Wallet, or send it to someone.