Overview

The Google Wallet Passes API provides the ability for partners to save Rotating Barcodes to the Google Wallet. These barcodes are only valid for a short period of time, providing additional security to reduce the risk of barcode screenshotting. The barcodes are generated on device in accordance with RFC 6238, with the partner providing the secret key. However, if a partner would rather generate the barcodes themselves, Google provides an API such that barcodes can be batch uploaded to Google. These barcodes will then be passed through to users' phones, where they will act just like Rotating Barcodes, displaying for a short period of time. We refer to this solution as Partner-Generated Rotating Barcodes.

Partner-Generated Rotating Barcode API

Partner-Generated Rotating Barcodes are created using the same RotatingBarcode object. Only the type is required, although we also recommend creating a small, starter set of barcodes (~10 minutes worth), and sending them in initialRotatingBarcodeValues. The partner is responsible for ensuring that there is always a valid barcode ready for the user, and initialRotatingBarcodeValues allows the subsequent batch upload call to be asynchronous.

  rotatingBarcode {
    initialRotatingBarcodeValues: object (RotatingBarcodeValues),
    type: enum (BarcodeType),
  }
Field Description
initialRotatingBarcodeValues

object (RotatingBarcodeValues)

The values to encode in the barcode. At least one value is required. These initial barcodes are meant to bridge the gap between when the user first acquires their pass, and when the subsequent batch upload call is made.
type

enum (BarcodeType)

Required. The type of this barcode.

Acceptable values are:

  • QR_CODE
  • PDF_417
RotatingBarcodeValues
Field Description
startDateTime

string

The date/time the first barcode is valid from. Barcodes will be rotated through using periodMillis.

This is an ISO 8601 extended format date/time, with an offset.
values[]

string

The values to encode in the barcode. At least one value is required.

There is no maximum number of values, but note that the size of the request body cannot exceed 5MB.
periodMillis

number

The amount of time each barcode is valid for.

Batch updating barcode values

After the RotatingBarcode object has been created, we recommend uploading a day's worth of barcodes, every day, until the user's pass expires. This can be done with the following REST API endpoint.

Method: transitobject.uploadrotatingbarcodevalues

Uploads rotating barcode values to the transit object referenced by the given object ID.

HTTP request

POST https://walletobjects.googleapis.com/upload/walletobjects/v1/transitObject/{resourc eId}/uploadRotatingBarcodeValues

Path parameters

Parameter Description
resourceId

string

The unique identifier for an object.

Request body

The request body (which cannot exceed 5MB) contains an instance of RotatingBarcodeValues.

Method: transitobject.downloadrotatingbarcodevalues

Downloads rotating barcode values for the transit object referenced by the given object ID. This is useful if partners want to verify the latest batch.

HTTP request

GET https://walletobjects.googleapis.com/walletobjects/v1/transitObject/{resourceId}/do wnloadRotatingBarcodeValues?alt=media

Path parameters

Parameter Description
resourceId

string

The unique identifier for an object.

Fallback mechanisms

Note that if an otherwise-valid RotatingBarcode has no valid barcodes to display (they haven't been uploaded yet, or all the current barcodes have been used), an error message will be shown to the user.