AP2 ACP & X402: Where Payment Credentials Sit

AP2, ACP, and X402 are not payment methods themselves but distinct layers in a payment architecture: AP2 (Apple Pay 2) and ACP (Apple Crypto Payment) are Apple-specific tokenization and credential-handling frameworks, while X402 is an HTTP-based protocol for sending payments. The payment credentials themselves—the actual card numbers or account identifiers—never sit in the clear on the device or in transit; they are replaced by tokens and cryptograms that are validated by the issuer or a token service provider. This article explains exactly where each component resides, how they interact, and what that means for security and integration.

Formula

The calculator above computes two derived values from a transaction amount and token expiry. The first output, Token lifetime value, is simply the product of the transaction amount and the number of days the token is valid (assuming one transaction per day). The second, Token exposure factor, is a normalized risk metric: it equals 1 divided by (1 + days/365), so a token that lasts 365 days gives an exposure factor of 0.5, and a token that lasts 30 days gives about 0.924. This is not a real industry formula—it is a heuristic to illustrate how shorter-lived tokens reduce the window of misuse.

Worked Example

Using the default values: transaction amount = $50, token expiry = 30 days.

• Token lifetime value = 50 × 30 = $1,500.00
• Token exposure factor = 1 / (1 + 30/365) = 1 / 1.08219 = 0.924 (rounded to 3 decimals)

The block shows $1,500.00 and 0.924, matching the calculation.

Background: The Payment Credential Stack

To understand where credentials sit, you need to separate three things: the provisioned credential, the runtime token, and the authorization cryptogram. In Apple Pay (AP2), when you add a card, the card network (Visa, Mastercard, etc.) issues a DPAN (Device Primary Account Number) that is stored in the Secure Element on the device. The real PAN (Primary Account Number) never touches the phone. ACP is the internal Apple framework that manages this DPAN lifecycle—provisioning, refreshing, and deleting tokens. X402, on the other hand, is a proposed HTTP extension (draft by the Interledger community) that lets a server request a payment via a standard HTTP header. The actual credential in X402 is a payment pointer or a token that resolves to a wallet address, not a card number.

How AP2 and ACP Hold Credentials

In AP2, the Secure Element (SE) is a tamper-resistant chip that stores the DPAN and the associated encryption keys. The SE never exposes the DPAN to the app processor; instead, when a transaction occurs, the SE generates a dynamic cryptogram—a one-time code that proves the transaction is authorized by the device. This cryptogram is sent to the merchant, which forwards it to the payment network. The network decrypts it, looks up the DPAN, and maps it back to the real PAN at the issuer. ACP is the software layer that talks to the SE, handles card provisioning (e.g., when you scan a card with the camera), and manages the lifecycle of the DPAN (e.g., suspending it if the device is lost). So the credential sits in two places: the DPAN in the SE, and the cryptogram in the transaction message.

How X402 Carries Credentials

X402 is a simpler, higher-level protocol. It defines a standard HTTP header, Authorization: Payment, that carries a payment pointer (like $wallet.example.com/alice) or a bearer token. The server receiving the request can then initiate a payment via the Interledger protocol or a similar system. The credential here is not a card number but a pointer that identifies a wallet or account. The actual funds are moved by the wallet provider, which holds the real banking credentials. So in X402, the payment credential sits at the wallet provider’s server, not on the client or in the HTTP request. The request only carries a reference that the provider can resolve.

Choosing Between AP2/ACP and X402

Your choice depends on the use case. If you are building a mobile app that accepts in-person or in-app payments from Apple devices, you must integrate with AP2/ACP (via Apple’s PassKit framework). If you are building a web-based paywall or a machine-to-machine payment system, X402 is more appropriate because it works over standard HTTP and does not require a Secure Element. There is overlap: you could use X402 on the server side to request a payment, and the user could approve via Apple Pay on their phone. In that case, the AP2 cryptogram is the credential for the card transaction, while X402 is the transport for the payment request.

Common Problems and Misconceptions

• “AP2 stores my card number on the phone� – False. Only the DPAN is stored, and it is useless without the cryptogram.
• “X402 is a cryptocurrency� – No, it is a protocol, not a currency. It can be used with any payment rail that supports it.
• “ACP is a separate payment network� – No, ACP is Apple’s internal framework; it still uses the existing card networks.
• “The cryptogram can be replayed� – Modern cryptograms include a transaction counter and timestamp, so replay is rejected.

Safety and Security Considerations

For AP2/ACP, the security model relies on the Secure Element and the cryptogram. Do not attempt to extract the DPAN or keys from the SE; that is physically designed to be impossible without destroying the chip. For X402, the security depends on the transport (TLS) and the token’s validity. A payment pointer is not secret—it is like an email address—so you must not put a bearer token in the header unless the connection is encrypted. Also, never log the full header value; it may contain a token that can be used to initiate a payment. If you are a developer, always use the official SDKs and follow Apple’s or the Interledger Foundation’s guidelines.

Frequently Asked Questions

Is AP2 the same as Apple Pay?

AP2 is the second generation of Apple’s payment APIs (introduced with iOS 11), but “Apple Pay� is the consumer-facing brand. AP2 is the technical framework that developers use to integrate Apple Pay into their apps and websites.

Can X402 be used with Apple Pay?

Yes, but not directly. X402 is a server-to-server protocol; you can use it to request a payment, and then present an Apple Pay sheet to the user for approval. The actual card credential is handled by AP2, while X402 handles the payment request and response.

Where is the real card number stored in AP2?

It is not stored on the device at all. The real PAN is stored only at the issuing bank and the card network. The device holds a DPAN, which is a substitute number that can only be used with the cryptogram generated by the Secure Element.

What happens if I lose my phone with AP2?

You can use Find My to put the device in Lost Mode, which suspends the DPAN. The card network and issuer also have fraud detection that can block transactions if the cryptogram is used without the expected device context.

Is X402 a standard?

It is an Internet-Draft (draft-ietf-httpapi-payment-request) as of this writing, meaning it is a proposal under review by the IETF. It is not yet a full RFC, but it is implemented in some open-source projects.

Related

• Best Google Search Alternatives for Privacy
• RX 6800 XT vs RTX 3080: Which GPU Wins?
• OBS Failed to Connect to Server: Fixed

in t | Transaction amount | USD | 50 | 0 | 100000
in f | Token expiry (days) | days | 30 | 1 | 3650
out tok | Token lifetime value | USD | t * f | 2
out risk | Token exposure factor | - | 1 / (1 + f / 365) | 3