Connections between Google and Issuer servers must adhere to the following
requirements:
Both Google and Issuers must present keys during TLS handshakes
Servers must not offer NULL or anon ciphers during TLS handshakes
Connections must support one of the following ciphers
ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
ECDHE-ECDSA-WITH-AES-256-GCM-SHA384
ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256
ECDHE-RSA-WITH-AES-128-GCM-SHA256
ECDHE-RSA-WITH-AES-256-GCM-SHA384
ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256
All Issuers are required to use mTLS when communicating with Google servers.
Google to Issuer communication
When Google communicates to Issuer servers, Google will present a client
certificate. Issuers are responsible for pinning and validating this
certificate. Google will then validate a pinned server certificate against what
is presented by the Issuer.
Issuer to Google communication
When Issuers communicate to Google servers using the Google Wallet Identity APIs, they must
present a client certificate. Google will validate this against a pinned
certificate.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-08-21 UTC."],[],[]]