Validate an Apple Pay merchant session
Requests a merchant session from Apple’s startSession endpoint on behalf
of the storefront domain. Requires a Referer header naming the
storefront: the referer host must match a verified Apple Pay domain or a
shared checkout domain, otherwise the request is rejected with 422
before Apple is contacted. The payment account used for the Apple session
may differ from the account pinned for routing.
curl --request POST \
--url https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate \
--header 'Content-Type: application/json' \
--header 'Referer: <referer>' \
--data '
{
"company_id": 1024,
"country_id": 233,
"apple_session_url": "https://apple-pay-gateway.apple.com/paymentservices/startSession"
}
'import requests
url = "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate"
payload = {
"company_id": 1024,
"country_id": 233,
"apple_session_url": "https://apple-pay-gateway.apple.com/paymentservices/startSession"
}
headers = {
"Referer": "<referer>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Referer: '<referer>', 'Content-Type': 'application/json'},
body: JSON.stringify({
company_id: 1024,
country_id: 233,
apple_session_url: 'https://apple-pay-gateway.apple.com/paymentservices/startSession'
})
};
fetch('https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'company_id' => 1024,
'country_id' => 233,
'apple_session_url' => 'https://apple-pay-gateway.apple.com/paymentservices/startSession'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Referer: <referer>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate"
payload := strings.NewReader("{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Referer", "<referer>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate")
.header("Referer", "<referer>")
.header("Content-Type", "application/json")
.body("{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Referer"] = '<referer>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}"
response = http.request(request)
puts response.read_body{
"apple_pay": "{\"epochTimestamp\":1700000000000,\"merchantSessionIdentifier\":\"SSH1234\"}",
"meta": {
"request_id": "018f2c1a-8b3a-7e6d-9f10-2a3b4c5d6e7f",
"timestamp": "2026-04-01T12:00:00Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"code": "payment_in_progress",
"shop_url": "<string>",
"cart": {}
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"shop_url": "<string>",
"cart": {}
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}Headers
Storefront page URL initiating the Apple Pay session. The host must
match a verified Apple Pay domain or a shared checkout domain; requests
without a referer, or with an unrecognized host, are rejected with
422.
Path Parameters
Opaque cart token returned by the create-cart response. It scopes the request to a single cart and is the credential for these endpoints — cart-token authentication carried in the path, with no bearer token or API key.
Body
Apple Pay startSession endpoint URL provided by the Apple Pay JS onvalidatemerchant event. Must be an HTTPS URL on an Apple Pay gateway host (apple-pay-gateway*.apple.com or cn-apple-pay-gateway*.apple.com); any other URL is rejected with 422 before Apple is contacted.
Response
Merchant session
Success body for Apple Pay merchant validation. apple_pay is Apple's raw startSession response body as a JSON-encoded string.
curl --request POST \
--url https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate \
--header 'Content-Type: application/json' \
--header 'Referer: <referer>' \
--data '
{
"company_id": 1024,
"country_id": 233,
"apple_session_url": "https://apple-pay-gateway.apple.com/paymentservices/startSession"
}
'import requests
url = "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate"
payload = {
"company_id": 1024,
"country_id": 233,
"apple_session_url": "https://apple-pay-gateway.apple.com/paymentservices/startSession"
}
headers = {
"Referer": "<referer>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Referer: '<referer>', 'Content-Type': 'application/json'},
body: JSON.stringify({
company_id: 1024,
country_id: 233,
apple_session_url: 'https://apple-pay-gateway.apple.com/paymentservices/startSession'
})
};
fetch('https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'company_id' => 1024,
'country_id' => 233,
'apple_session_url' => 'https://apple-pay-gateway.apple.com/paymentservices/startSession'
]),
CURLOPT_HTTPHEADER => [
"Content-Type: application/json",
"Referer: <referer>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate"
payload := strings.NewReader("{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Referer", "<referer>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate")
.header("Referer", "<referer>")
.header("Content-Type", "application/json")
.body("{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fluid.app/api/payments/v2026-04/carts/{cart_token}/apple_pay/validate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Referer"] = '<referer>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"company_id\": 1024,\n \"country_id\": 233,\n \"apple_session_url\": \"https://apple-pay-gateway.apple.com/paymentservices/startSession\"\n}"
response = http.request(request)
puts response.read_body{
"apple_pay": "{\"epochTimestamp\":1700000000000,\"merchantSessionIdentifier\":\"SSH1234\"}",
"meta": {
"request_id": "018f2c1a-8b3a-7e6d-9f10-2a3b4c5d6e7f",
"timestamp": "2026-04-01T12:00:00Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"code": "payment_in_progress",
"shop_url": "<string>",
"cart": {}
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z",
"shop_url": "<string>",
"cart": {}
}
}{
"error_message": "<string>",
"errors": "<string>",
"meta": {
"request_id": "<string>",
"timestamp": "2023-11-07T05:31:56Z"
}
}