--- title: "Initiate unified Google Pay push provisioning flow" method: POST path: "/v1/cards/{card_id}/sca_push_provision/google_unified" tags: ["Push provisioning"] --- # Initiate unified Google Pay push provisioning flow `POST /v1/cards/{card_id}/sca_push_provision/google_unified` Initiates the **Google Pay Unified Push Provisioning** flow. Unlike standard provisioning, the Unified flow allows a user to simultaneously add a card to their device's Google Wallet (for tap-to-pay) **and** save the actual card number to their broader Google Account (for online and Chrome autofill).

Because this flow handles the actual card number, it requires **Strong Customer Authentication (SCA)**.

**Integration Flow:**
1. **Trigger SCA:** Calling this endpoint initially returns a `200 OK` and triggers a **Change Request**. The customer must complete a 2FA challenge.
2. **Fetch Payloads:** Once authorized, the endpoint returns the two required Opaque Payment Cards (OPCs):
**Important:** Do not attempt to parse, decode, or modify the Google OPC string. Your backend must pass both OPCs exactly as received directly to your mobile client, which will feed them into the Google Wallet SDK. ## Path parameters - `card_id` string, required ## Request body - PushProvisionGoogleUnifiedRequest - `wallet_id` string — The wallet ID of the active wallet on the selected device. A unique 24-byte identifier for each instance of an [Android user, Google account] pair. Provided by Google's TapAndPay SDK via the GeneratePaymentCredentialsRequest. - `stable_hardware_id` string — The stable hardware ID of the selected device. A stable identifier for a physical Android device, provided by Google's TapAndPay SDK. Optionally used by certain TSPs during OPC generation. Use the `getStableHardwareId` method to retrieve this value. - `token_requestor_id` string — Unique identifier for the token requestor, provided by Google's TapAndPay SDK. Recommended for Visa cards — Visa may require issuers to embed this value in the TSP OPC. For non-Visa cards this field is accepted but not used in OPC generation. - `server_session_id` string, required — A push provisioning session ID in the form of a UUID, generated by Google's server and provided via the TapAndPay SDK. Used to generate the Google OPC, which enables saving the card's FPAN to the user's Google Account. The destination user is implied by the session. ## Response `200` The request was accepted and requires Strong Customer Authentication (SCA). The response contains a Change Request ID. The customer must confirm this change request via 2FA before the payloads can be generated. - PushProvisionChangeRequestResponse - `id` string — ID of the change request. - `status` 'ACCEPTED' | 'AUTHORIZATION_REQUIRED' | 'CONFIRMATION_REQUIRED' | 'COMPLETED' | 'FAILED' — The current status of the change request. - `updated_at` string, date-time — UTC timestamp from the last time the change request was updated. - `url` string — URL to use to authorize the change request. ## Other responses - `201` — The change request was successfully confirmed. This response is returned containing the cryptographic payloads. The client application must pass both the TSP OPC and the Google OPC to the Google Wallet SDK to finalize provisioning. - `400` — Bad Request. The request was invalid or malformed. - `401` — Unauthorized. Authentication is missing or invalid. - `403` — Forbidden. The client does not have access rights to the content. - `404` — The card could not be found. - `500` — Internal Server Error. The server has encountered a situation it does not know how to handle. --- [API](https://skmtc.net/solarisgroup/apis/cards-tokenization.md) · [All operations](https://skmtc.net/solarisgroup/apis/cards-tokenization/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/solarisgroup/cards-tokenization/revisions/15f03804be72/schema)