Concierge Setup

We handle the Apple paperwork.

Setting up an Apple Developer Account, getting a Pass Type ID, generating CSRs, dealing with App Store Connect API keys — most owners give up halfway through. Book a 30-minute screenshare. You watch. We type. You walk away with a fully configured cert.

$299 one-time setup · $19/mo renewal management · you keep your Apple Developer Account
Book a setup call →
How it works

Four steps. Thirty minutes.

1

Apple Developer Account ($99/yr → Apple)

We walk you through enrollment in the Apple Developer Program. Apple usually verifies your business within 24 hours.

We navigate the portal and fill the right fields. You enter your credit card directly with Apple — we never see it.
2

Pass Type ID + Identifier

We create a unique Pass Type ID for your business — e.g., pass.com.yourbusiness.loyalty. This is what Apple Wallet uses to identify your passes as yours.

PassThru-side: we mirror this ID into your dashboard so every pass auto-fills it. No copy-paste from you.
3

App Store Connect API key

We generate an API key with Developer-tier access (limited scope — can't touch billing or apps). You download the .p8 file and drag it into the dashboard.

Security: the .p8 is encrypted in transit, stored in HSM-backed Key Vault, used only by the automated cert-renewal cron. Never logged, never displayed.
4

Cert generation + automatic renewal

We generate a CSR inside Azure Key Vault (the private key is born in the HSM and never leaves), submit it to Apple, merge the signed cert back. From now on your passes are signed by your cert — and we auto-renew it 30 days before expiry, every year.

What you do: nothing. The renewal cron runs nightly. You'll get an email only if Apple ever needs your attention directly.
DIY

Do it yourself

Free. Bring your own Apple Developer Account.

Start in the dashboard →
Concierge — Recommended

We do it with you

$299 setup + $19/mo. You watch. We type.

Book a setup call →
WHAT WE NEVER SEE Your Apple ID password — you log in yourself on the call.
Your credit card — you enter it directly with Apple.
Your private key — born in Azure Key Vault HSM, signs remotely, never exported. WHAT WE STORE .p8 API key — Azure Key Vault, encrypted, used only by renewal cron.
Pass Type ID + Team ID — Cosmos DB tenant record, partition-isolated.
Signed cert — Azure Key Vault, public portion only, auto-rotated. HOW WE SIGN Pass signing — Azure Key Vault CryptographyClient. Hash sent to Vault, signature returned. Private key bytes are not in transit at any point.

Ready to ship?

Pick a time that works. We'll send a calendar invite with the Zoom link and a checklist (credit card, business name, a coffee).

hello@marckoyindustries.org → Or DM the founder on Twitter / LinkedIn. We confirm same-day.