What changed in WalletWallet API.
notification on a pass now shows its text on the lock screen, so a pass no longer needs a single space at create. PUT that omits notification keeps the current message, so an update of other fields no longer needs to repeat it. null or an empty string removes the message. The message is trimmed. 
notification field on POST /api/passes and PUT /api/passes/<serial> holds the lock-screen message. Apple Wallet shows the new value as the banner on every update that changes it, and Google Wallet lists it in the pass details and sends its own notification. Create the pass with a single space so the first message banners. Available on every plan, up to 256 characters. backFields entry labeled Notifications with changeMessage "%@". A pass that already carries that entry keeps working as before. place featured action now carries a placeIdentifier, the Apple Maps Place ID of the venue (such as I7C250D2CDCB364A, from Apple's Place ID Lookup), instead of a URL. iOS 27 opens the place in Maps straight from the tile. The pass editor shows a Place ID field when the action type is Go to Location. place action that only has a URL, and logs a warning that a future release will refuse the whole pass. The API now returns a 400 for that shape, and a pass created before this change leaves such an action out of its Apple bundle on its next rebuild. Nothing visible changes on the phone. place action may still carry a url, which only Google Wallet uses: a Google Maps share link opens the Maps app on Android. Without one the button shows the place on maps.apple.com. expirationDate field on POST /api/passes and PUT /api/passes/<serial> sets the exact instant a pass expires, as an RFC 3339 date-time with a UTC offset such as 2027-01-31T23:59:00Z. Apple Wallet files the pass under Expired at that instant and Google Wallet ends its validity. Available on every plan, at most 10 years ahead, and never together with expirationDays. expirationDays keeps counting from the request that sets it, so an update that sends it restarts the count. Send expirationDate when the date must survive updates. A past expirationDate on an update expires a live pass without revoking it, and a later update with a future date brings it back. expirationDate, the absolute UTC instant the pass carries, for both fields. The binary endpoint returns it as the X-Expiration-Date header. pass.walletwallet.dev and on their custom domain. Dashboard › Share page sets the page background, the card color, the card text color, a logo or brand name above the card, the headline, a footer line with a link, and a favicon. A live preview shows the page before you save. pass.walletwallet.dev. shareUrl and the X-Pass-Url header return the new host, and links on api.walletwallet.dev redirect to it. passes.example.com instead of pass.walletwallet.dev. Add the host on Dashboard › Custom domain, create the CNAME record it shows at your DNS provider, and the page checks the status until the certificate is active. One subdomain per team; an apex domain cannot be added. shareUrl in the create response, the X-Pass-Url header, the CSV export, and the share links and QR codes in the Pass Editor and the Pass Manager all use it. The path stays /p/<serial>, so existing links on pass.walletwallet.dev keep working. pass.walletwallet.dev at once. credentials field of POST /api/passes and the pass is issued under your identity end to end. An account holds as many sets as it needs, one per brand or per client. .cer back. /api/credentials. Stored key material is encrypted at rest and never echoed back. The Pass Manager, the pass status, and the CSV export show which set each pass uses, and the list filters by set. googleSaves number: the Google Wallet saves of a pass minus its removals. The Pass Manager and the editor show it next to the Apple device count. googleInstalled and googleSaved keep working unchanged. ww_live_ key keeps working unchanged for the API, MCP, and Zapier. featuredActions (Pro) puts up to two tappable tiles under the pass on iOS 27 and later. Each action is an identifier, one of Apple's fourteen action types, and a link; Apple draws the icon and label from the type. Google Wallet shows the same actions as link rows in the pass details, and older iOS ignores the field. Full guide: Featured Actions and poster passes. backgroundURL (Pro) switches a pass to Apple's poster layout: the artwork fills the pass, with the logo, one header field, up to four primary fields, up to two footerFields, and the barcode over it. The pass carries the classic layout next to it, so iOS 26 and earlier show that one, and Google Wallet uses the artwork as its image band when there is no strip. PUT and installed passes update in place on both wallets. https://api.walletwallet.dev/mcp. Connect it to Claude, ChatGPT, or any MCP client with OAuth and create, update, or revoke passes by describing them. Check them out on the Integrations page in the dashboard. wideLogoURL field puts a 1280×400 px transparent PNG wordmark top-left of the Google Wallet card, uncropped. When it is set, Google drops logoText and the round logo from the card. logoURL and falls back to the wide logo only when logoURL is absent. barcodeAltText field controls the line under the code. Send any string up to 128 characters and both wallets print it, or send an empty string and neither prints anything. {{column}} tokens anywhere in the template, so each pass carries its own row's name, member id, tier, or barcode value. label (or send an empty string) in primaryFields, secondaryFields, headerFields, or backFields and the value renders alone, with no label above it, on both wallets. cardLabel: "" with title for a label-less title field. Omitting cardLabel keeps the CARD default, so nothing changes for existing integrations. .pkpass at 10MB. A request that exceeds any of these returns 400. logoURL at 160×160 px, iconURL at 120×120 px, thumbnailURL at 180×180 px, and stripURL at 1080×360 px. These are the sizes the editor produces. barcodeValue to issue a pass with no barcode at all, on both wallets. Built for passes that are shown rather than scanned: completion certificates, membership and discount cards presented to staff, contact cards. barcodeValue, a valid barcodeFormat is required exactly as before. DELETE /api/passes/<serial> revokes a pass you issued (legacy alias DELETE /api/pkpass/<serial>). PUT. POST /api/passes returns one JSON response with the Google Wallet save URL (googleSaveUrl), the signed Apple pass (applePass), and a shareUrl. shareUrl is a hosted, share page at /p/<serial> that shows the right Add to Wallet button on a phone and a QR code to scan on desktop, so you can share a pass without building your own page. ?format=pkpass to stream the binary .pkpass straight to -o card.pkpass. POST /api/pkpass and PUT /api/pkpass/<serial> keep working exactly as before. They will be retired in a future release, so point new integrations at /api/passes. sharingProhibited field. It defaults to true to keep passes private (best for loyalty and membership cards). Set false to show the Apple Wallet share button on shareable passes. PUT /api/pkpass/<serial> changeMessage on field arrays to set the lock-screen banner text per field iconURL to replace the lock-screen notification icon organizationName X-Serial-Number response header on POST /api/pkpass stripURL for a wide banner image behind the primary field. It automatically switches the pass to a store card layout. thumbnailURL for a square image in the top-right of the pass, ideal for a member photo or product shot. cardLabel to replace the default "CARD" label above the pass title.