Skip to main content

​
Architecture Overview

Pcnaid Lifecycle Manager for Apple Pay® runs an event-driven, multi-tenant edge architecture on Cloudflare Workers (Enterprise tier) with dedicated microservices handling mutual TLS cryptographic handshakes and payment processing.

​
Production components

​
1. Merchant Dashboard (lifecyclemanager.app)

A Next.js 14 Single-Page Application deployed to Cloudflare Workers via @opennextjs/cloudflare. Embeds Stripe Connect components for KYC, payouts, disputes, and tax registration. Authentication is secured by Auth0 (RS256/JWKS).

​
2. Control Plane (api.lifecyclemanager.app)

A high-throughput Hono Worker that acts as the sole custodian of platform secrets and internal routing logic. Backed by Render Postgres via Cloudflare Hyperdrive for connection pooling, Redis Cloud for idempotency and rate limiting, and Cloudflare KV for hot merchant lookups.

​
3. Multi-Tenant Checkout Worker

Edge worker deployed across Cloudflare’s global network serving checkout subdomains:
  • Free / Starter Tier: pay.lifecyclemanager.app/{merchant}
  • Pro Tier: applepay.{merchant}.com via Cloudflare Custom Hostnames with automated SSL provisioning.
  • Serves /.well-known/apple-developer-merchantid-domain-association directly from KV.
  • Renders the Apple Pay JS sheet and proxies merchant validation requests.

​
4. Azure mTLS Adapter (com.pcnaid.applepay.adapter)

A permanent Node.js service running on Azure App Service. This service holds Pcnaid’s Apple Merchant Identity Certificate and executes outbound mutual TLS handshakes with Apple’s servers.
Why Azure mTLS is required: Cloudflare Workers cannot establish outbound mutual TLS (mTLS) to Apple Pay servers because both Apple Pay validation endpoints and Cloudflare Workers sit behind Cloudflare’s edge network, creating an SSL/TLS handshake collision. The Azure proxy bridges this gap with dedicated hardware-backed certificates.

​
5. Slim Storefront Connectors

Platform-specific private connectors (such as the Shopify private custom app). Connectors perform three focused tasks:
  1. Facilitate OAuth and permission authorization.
  2. Forward order webhooks to the Control Plane.
  3. Inject the Apple Pay theme extension block into product and cart pages.

​
6. Stripe Connect Decryption & Settlement Layer

Stripe acts as Pcnaid’s decryption and banking partner. When an encrypted Apple Pay token arrives, Stripe decrypts the payload inside its PCI DSS Level 1 vault using the Payment Processing Certificate whose private key Stripe holds. Stripe deducts Pcnaid’s 1% platform application fee and deposits the net proceeds into the merchant’s Connected Account.

​
7. Universal Commerce Protocol (com.pcnaid.applepay)

Published open specification under Apache-2.0 at ucp.pcnaid.com. Governs the data schemas and handler integration contracts for AI shopping agents (via MCP) and inter-platform commerce.