Google Pay Wallet Provisioning

​

Overview

​

Key Benefits

• Contactless Payments - Enable cardholders to pay with their phone via NFC
• Real-time Webhook - Receive the verification code programmatically to surface in your app
• Secure Verification - OTP-based ownership verification before activation
• Multi-channel Delivery - Code delivered via both SMS and webhook

​

How It Works

​

Provisioning Lifecycle

1. Initiation - Cardholder taps “Add to Google Wallet” on their device
2. Eligibility Check - Mastercard verifies the card is eligible for provisioning
3. Code Generation - UTGL generates a 6-digit verification code
4. Code Delivery - Code is sent via SMS to the cardholder and via webhook to your system
5. Verification - Cardholder enters the code in Google Wallet
6. Activation - Card is activated and ready for contactless payments

​

Prerequisites

1. Google Pay Enabled - Your card product must have Google Pay provisioning enabled. Contact your solution manager to enable this feature.
2. Registered Mobile Number - The cardholder must have a mobile phone number on file for SMS delivery.
3. Email Address - The cardholder must have an email address on file for confirmation notifications.

​

Webhook Event

​

cardaccount.googlepay.verification-code-delivered

​

Event Structure

{
  "event": "cardaccount.googlepay.verification-code-delivered",
  "id": "evt_1a2b3c4d5e6f7g8h9i0j",
  "time": "2026-02-05T10:30:00.000Z",
  "data": {
    "cardId": "438f4574-8d75-4938-8667-e626d181da19",
    "verificationCode": "482916"
  }
}

​

Event Data Fields

​

Webhook Handler Example

app.post('/webhooks/utgl', async (req, res) => {
  const signature = req.headers['x-utgl-signature'];
  if (!verifyWebhookSignature(req.body, signature)) {
    return res.status(401).send('Invalid signature');
  }

  const event = req.body;

  if (event.event === 'cardaccount.googlepay.verification-code-delivered') {
    const { cardId, verificationCode } = event.data;

    // Option 1: Display the code in your app
    await notifyCardholder(cardId, {
      type: 'google_pay_verification',
      code: verificationCode,
      message: 'Enter this code in Google Wallet to complete setup'
    });

    // Option 2: Log for support reference
    await logProvisioningEvent(cardId, verificationCode);
  }

  res.status(200).json({ received: true });
});

​

Notification Channels

​

Timing and Expiry

​

Integration Guide

​

Step 1: Configure Webhook Endpoint

​

Step 2: Handle the Verification Code

• Push Notification - Send a push notification to the cardholder’s device with the code
• In-App Display - Show the code in a dedicated section of your app
• SMS Fallback - The cardholder will also receive the code via SMS (handled by UTGL)

​

Step 3: Monitor Activation

​

Best Practices

​

User Experience

1. Surface the Code - Use the webhook to display the verification code in your app for a seamless experience
2. Show Expiry Timer - Display a countdown timer so the cardholder knows how long the code is valid
3. Clear Instructions - Guide the cardholder to enter the code in Google Wallet, not in your app

​

Reliability

1. Idempotency - Use the event id field to prevent duplicate processing
2. Event Logging - Log all provisioning events for support and debugging
3. Webhook Signature Verification - Always verify incoming webhook signatures

​

Security

1. Don’t Store Codes - Treat verification codes as transient; do not persist them long-term
2. Secure Display - If displaying the code in your app, ensure the display is secure and time-limited
3. Verify Webhook Origin - Always validate webhook signatures before processing

​

Troubleshooting

​

Next Steps