Adding an Apple Wallet Stamp Card to a Rork Max App — Signing and Updates

Adding to Wallet from the App

Once you receive the signed .pkpass from the server, the app just uses PassKit to present the add-to-Wallet screen. This is a few dozen lines of Swift.

import PassKit
 
func presentAddPass(from data: Data, on presenter: UIViewController) {
    guard let pass = try? PKPass(data: data) else {
        print("Invalid pkpass data")
        return
    }
    guard let vc = PKAddPassesViewController(pass: pass) else { return }
    presenter.present(vc, animated: true)
}

PKPass(data:) throws if the signature is broken. This is where I first got stuck — the cause was a mismatch between the image filenames in the server's manifest and the images actually placed in the ZIP. A hash mismatch only ever surfaces as "invalid pass," so isolating the cause takes time. The manifest and ZIP contents must match exactly, down to filename and bytes.

You can check whether it is already added with PKPassLibrary:

let library = PKPassLibrary()
let alreadyAdded = library.containsPass(pass)

Trigger Per-Visit Updates with Push

Here is the heart of it. When you add a stamp, you want to update the Wallet card face without the user doing anything. PassKit's Web Service makes this happen. The flow:

When the user adds the pass to Wallet, the device sends a "register this pass" request to webServiceURL. The server stores the device's push token linked to the pass serial number. When a stamp increases, the server sends an empty, pass-specific push via APNs. No notification is shown; it is a signal for Wallet to fetch the latest .pkpass from webServiceURL in the background.

The server should implement four main endpoints: device registration (POST .../registrations/...), unregistration (DELETE), returning the list of updated serial numbers (GET .../passes/...), and returning the latest pass (GET .../passes/{type}/{serial}). On receiving a push, Wallet first asks the list endpoint "which passes changed," then fetches the individual pass.

The nice thing about this design is that updates arrive even when the app is not running. In practice, the number of times users opened the app dropped, yet the return-visit rate held up. I believe seeing the stamps on the lock screen acts as a quiet reminder.

What to Check First

Once PassKit is in, send a test empty push from the server to a real device and watch whether the Wallet card face updates on its own. Many articles cover up to adding a pass; pushing through to the update is what first makes a stamp card a "living card face." Beyond matching signature hashes and push updates lies the value of replacing the paper card — that is how it feels to me.