Google Pay

Phase 1: Google Onboarding

1

Issuer agreement

Issuers are required to have a signed Google Pay CTA Agreement in order to request access to the Push Provisioning API.

2

Access Google documentation

Use a Google Account associated with a corporate email address to access the Google's Android Push Provisioning API documentation.

3

UX / branding review

UX/branding Review: Google requires issuers to adhere to best practices and branding guidelines. The application UX needs to be submitted to Google for review.

4

Request API access

Request access to Google's Push Provisioning API by submitting a form with issuer app's package name and fingerprint(s) for particular environments (Sandbox, Production).

5

TSP configuration

Configure necessary settings on the TSP system according to Google Pay's requirements, paying close attention to especially the application package name.

Phase 2: Thales D1 Backend Integration

1

Onboarding Form

Onboarding Form: The Thales integrator provides the Thales D1 Onboarding Form to gather all necessary configuration parameters to connect to D1, including Connectivity, Keys, D1 Services Configuration, and Card Products.

The issuers are required to open a project with TSP(s) (Visa/Mastercard) for their push provisioning integration projects. This activity is recommended to be initiated in parallel to the onboarding with Thales.

2

Connectivity

Connectivity: The APIs exposed by D1 require TLS mutual authentication for all API calls, necessitating explicit setup for both pre-production and production environments with a client certificate signed by Thales CA.

3

Backend authorisation

Backend authorisation: Incoming D1 APIs are secured by OAuth JWT Bearer Credentials Flow, where your backend sends a signed JWT to obtain a D1 access token for accessing D1 APIs.

4

Data encryption

Data encryption: Sensitive information exchanged with the D1 backend must be encrypted using the standard JWE format with specific algorithms and the recipient's EC public key.

5

Consumer and Card Registration via API

Consumer and Card Registration via API: As a prerequisite for most D1 services, you must register end users, accounts, and cards in D1 via backend-to-backend APIs using unique identifiers.

6

Batch Registration

Batch Registration: D1 offers a service to execute certain operations (such as consumer & card registration) in batch mode using batch files uploaded via SFTP.

Phase 3: Thales D1 SDK Integration

1

Binary Integration

Binary Integration: The issuer must integrate the D1 SDK binary into its application project.

2

SDK Initialisation

SDK Initialisation: The issuer app must initialize the D1 SDK before it could call its APIs.

3

User Authentication

User Authentication: The issuer application must provide a proof of the end user authentication before it could consume D1 services.

4

Check Card State in Google Pay Wallet

Check Card State in Google Pay Wallet: The issuer app must check the card's digitization state in the Google Pay wallet using the D1PushWallet.getCardDigitizationState() API to determine the next action.

5

Pushing Card to Google Pay Wallet

Pushing Card to Google Pay Wallet: When the user taps "Add to Google Pay", invoke the D1PushWallet.addDigitalCardToOEM() API to tokenize the card, ensuring the onActivityResult method is overridden to pass the result back to the SDK.

Phase 4: Testing & Troubleshooting

1

Google Pay sandbox testing

The issuer is required to test their integration using first Google Pay sandbox mode.

2

Error handling and reporting

If issuers face errors in their tests they are required to first consult common errors before reporting the problem to Thales.

3

Production testing

Once issuers complete testing on Sandbox they should move to production environment and test there as well.

Phase 5: Certification & Launch

1

Self-certification & app review

Google Pay launch process requires the issuers to pass a self-certification of their application and submit video recordings of the tests to Google for an app review.

2

Field testing

Next, Google requires issuers to run a field testing of their app which must meet the exit criteria before the issuers could proceed with the final step.

3

Request launch approval

After meeting the exit criteria the issuers could request Google Pay team's launch approval and when that is received the issuers could release the application publicly.