Decrypt an Apple Pay payment token and extract the DPAN and cryptogram for authorization

Steps

1. Receive the PKPaymentToken from the Apple Pay payment sheet; the token contains an encrypted payment data blob and header metadata
2. Retrieve your Apple Pay payment processing certificate private key from secure storage; use it to perform ECDH key agreement with the ephemeral public key in the token header
3. Derive a symmetric decryption key using the ECDH shared secret combined with the merchant identifier and other header fields according to Apple's key derivation specification
4. Decrypt the payment data using AES-256-GCM with the derived key to obtain the decrypted payment data JSON, which contains the DPAN (device PAN), expiry, and payment cryptogram
5. Submit the DPAN, expiry, ECI indicator, and cryptogram to your payment processor in the authorization request, flagging it as a network token or wallet transaction as appropriate
6. Validate the token's transaction time and amount against your order before submitting; reject tokens where these values do not match the expected order