What Is a Wallet Approval? How Do You Revoke Token Permissions?

Wallet Approval Definition

1. Wallet approval refers to the explicit consent granted by a user to a third-party application or service to access specific resources or functionalities within their digital wallet.

2. This process typically occurs through an OAuth 2.0 authorization flow where the user is redirected to a secure wallet interface and prompted to confirm permissions such as viewing balance, initiating transfers, or managing stored credentials.

3. The approval generates an authCode and authState, both of which are passed back to the merchant via a predefined authRedirectUrl.

4. Approved scopes are strictly enforced—only those explicitly listed during the authorization request can be exercised by the client application.

5. Each approval is bound to a specific customerBelongsTo identifier, ensuring isolation between different wallet ecosystems like Samsung Wallet, Apple Wallet, or Huawei Wallet Cloud.

Token Revocation Mechanism

1. Token revocation terminates active session privileges associated with either an access_token or refresh_token issued during wallet authorization.

2. A valid client_id must match the one used in the original authorization request; inclusion of Team ID or other identifiers invalidates the revocation attempt.

3. The request requires a signed client_secret in JWT format, generated using the private key registered with the wallet provider’s developer portal.

4. The token_type_hint parameter helps optimize server-side validation but is not mandatory—if omitted, the system performs internal token type detection.

5. Successful revocation returns HTTP 200 with empty JSON body; no further action is required on the client side once this response is received.

Access Token Acquisition Flow

1. Access tokens serve as short-lived credentials enabling authenticated API calls to wallet cloud services such as Huawei Wallet Cloud or Samsung Wallet backend systems.

2. The token acquisition endpoint uses HTTPS POST with application/x-www-form-urlencoded content type and mandates grant_type=client_credentials.

3. Both client_id and client_secret must be transmitted as string literals enclosed in double quotes per specification.

4. Response includes access_token, token_type set to “Bearer”, and optional expires_in indicating lifetime in seconds.

5. Tokens expire after default 3600 seconds unless configured otherwise in the wallet provider’s admin console or partner onboarding dashboard.

Notification Template Lifecycle

1. Partners must register message templates through the Partner Portal before sending push notifications to wallet card holders.

2. Templates undergo automated harm verification checking for prohibited expressions, with results displayed as Pass or Fail alongside flagged content.

3. Rejected templates trigger email notification containing administrator comments; partners may revise and resubmit after addressing cited issues.

4. Only Merchant Push type notifications are permitted, with Message Type restricted to marketing or others categories.

5. Multi-language support requires separate template entries for each language added under General Information settings.

Card State Synchronization Protocol

1. Samsung Wallet sends real-time state updates—such as ADDED, UPDATED, or DELETED—to preconfigured partner servers whenever card status changes on a user device.

2. These events are delivered via server-to-server HTTPS callbacks using the Send Card State API endpoint.

3. Partner servers must be publicly accessible and capable of receiving and parsing JSON payloads containing cardId, state, timestamp, and device metadata.

4. Verification of card issuance status requires the wallet card template to be in VERIFYING or ACTIVE status prior to testing.

5. Integration relies on successful completion of Samsung Wallet onboarding, including certificate provisioning and domain whitelisting.

Frequently Asked Questions

Q: Can a revoked token be reused after reauthorization? A: No. Once revoked, the token becomes permanently invalid regardless of subsequent authorization attempts.

Q: Is authState value required to be cryptographically random? A: Yes. It must be a unique, unpredictable value generated per authorization request to prevent CSRF attacks.

Q: What happens if authRedirectUrl contains unencoded special characters? A: The wallet server rejects the request with HTTP 400 error due to malformed URI encoding requirements.

Q: Does token revocation affect other users sharing the same client_id? A: No. Revocation operates at the individual user-token level and does not impact permissions granted to other users.