Vai al contenuto principale
Tutti gli articoli
OperationsApr 29, 2026

Digital membership cards in Apple Wallet and Google Wallet

A digital membership card is a pass that a member saves to Apple Wallet on an iPhone or Google Wallet on an Android phone. It shows the member's name, tier and membership number with a barcode, often a QR code, that staff scan at reception, and the club can update it after it has been saved. Both wallets work in a similar way: the club's software creates the pass, the phone stores it, and the club sends changes when the membership changes.

That means a move to a higher membership tier, a renewal or a new points balance can appear on the card without printing anything, and members don't need to carry a separate plastic card.

How do Apple Wallet passes work?

Apple's Wallet passes framework covers boarding passes, event tickets, store cards, coupons and generic passes. Apple's design guidelines suggest the generic style for passes that don't fit the other categories, such as a gym membership card, and the store card style for loyalty and points cards, which usually show the current balance. Each pass is signed with a certificate tied to a pass type identifier created in an Apple Developer account, and a serial number identifies the individual pass.

Updates run through a web service you host. When a member saves an updatable pass, their device registers it with your server. When something changes, your server sends a push notification through Apple's push service, the device asks which passes have changed, and it downloads the new version. You can change anything on the pass except its serial number and authentication token.

How do Google Wallet passes work?

Google Wallet supports loyalty cards, gift cards, offers, event tickets, boarding passes, transit passes and generic passes, among others. Google suggests the generic pass for anything that doesn't fit a predefined type and mentions gym memberships as one use. Each pass has two parts: a class, which holds the details shared by every pass of that kind, and an object, which holds the details for one member.

The issuer updates passes through the Google Wallet API. Changes to a class apply to every pass that uses it, and members see them the next time their Wallet app syncs. Issuers can also add a message to a pass that triggers a push notification, up to three such messages per pass in 24 hours.

How do members add the card to their phone?

Apple lists three ways to distribute a pass: adding it from an app or App Clip, offering a download on a web page with an Add to Apple Wallet button, and sending it as an email attachment. Google uses an Add to Google Wallet link, made by adding a signed token to a Google URL, which can sit behind a button on a website or go in an email, a text message or an app.

For a club or gym, the natural moments are the welcome email after approval and the member's account page, so a new member has the card before their first visit. In Tiquo, each card has its own installation link, which you can send by email or offer on your website, in the customer portal or in an embedded booking flow, and the member adds the card to Apple Wallet or Google Wallet from that link.

QR code or NFC for a digital membership card?

Both wallets support QR codes and several other barcode formats, including PDF417, Aztec and Code 128. A barcode works with a camera-based scanner, and the same pass can be scanned at reception, the bar or the cloakroom. Tiquo's wallet cards carry a QR code that identifies the customer, and staff scan it with Tiquo's QR code scanner or an iPad camera.

Tap-to-identify with NFC takes more setup on both platforms. Apple says adding NFC to a pass requires a special entitlement that Apple issues, and the pass sends its NFC payload to an Apple Pay terminal. Smart Tap is Google's own NFC protocol, and Google requires certification to use it. For most clubs and gyms, a QR code and a desk scanner are enough to start with.

What should a membership card show?

Anyone holding the phone can see the front of the pass, so show what staff need at a glance: the member's name, membership number, tier and the barcode. A renewal date or status can help at the door if you keep it accurate. Put terms, contact details and opening hours on the back. The pass sits next to the member's bank cards and boarding passes, so it's worth designing with the same care as a printed card.

How to keep cards in step with membership status

Treat the pass as an identifier and check status in your own system when it is scanned. A pass can be out of date for a while if the phone hasn't synced, and a screenshot of a QR code still scans. When the scan looks up the live member record, a lapsed membership, an unpaid renewal or a ban shows up at the desk whatever the card says. Use pass updates for what members should see, such as a new tier, a renewal date or a points balance, and the live record for decisions about entry. In Tiquo, scanning a wallet card opens the customer's profile and shows their current membership status. If the membership has expired, the scan still identifies the member and shows that the membership is no longer active.

Digital membership cards in Tiquo

Tiquo issues wallet cards for Apple Wallet and Google Wallet, each linked to one customer profile, and a business can create several card designs, for example one for members and one for a loyalty programme. A change to a design applies to every card already issued from it, and installed cards update automatically when the member's details or membership status change. Staff can revoke a card from the customer's profile, and Tiquo revokes it automatically if the customer is banned or deleted. Membership plans can also carry permissions for member areas of a website, an app or member-only services.

At 180 Studios, members' and tenants' membership cards are in Apple Wallet and Google Wallet, so they don't need physical cards, and reception staff can see each person's identity, entitlements and history with the property.

© 2026 Tiquo. "Tiquo" e il logo Tiquo sono marchi registrati di Tiquo Ltd.

GDPR · CCPA · PCI DSS · ICO · Cyber Essentials Certified · EU–US DPF · SOC 2 Type II (in progress) · ISO 27001 (in progress)

Security & Operational

  • 99.99% SLA Uptime
  • AES-256 encryption at rest
  • TLS 1.3 in transit
  • AES-256 / TLS 1.3
  • Perfect Forward Secrecy (PFS)
  • HTTP Strict Transport Security (HSTS)
  • 99.999999999% (11 nines) data durability
  • Automated backups
  • DDoS protection
  • Web Application Firewall (WAF)
  • Zero Trust posture
  • Role-Based Access Control (RBAC)
  • Principle of Least Privilege
  • Secret scanning in CI
  • SBOM generation
  • Dependency supply-chain controls
  • 24/7 infrastructure monitoring
  • GDPR Article 22 safeguards
  • Data Protection Impact Assessments (DPIAs)
  • Records of Processing Activities (ROPA)
  • SAML 2.0 SSO
  • EASIE SSO
  • OAuth 2.0 / OpenID Connect (OIDC)
  • SCIM 2.0 provisioning
  • MFA / 2FA enforcement
  • Responsible disclosure / bug bounty programme

Privacy, Data Protection & Statutory Obligations

  • ICO Registered
  • UK Modern Slavery Act 2015 compliant
  • UK Public Interest Disclosure Act 1998 compliant
  • EU Article 27 Representative appointed (Paris, France)
  • Swiss FADP Article 14 Representative appointed
  • UK GDPR compliant
  • EU GDPR/DSGVO compliant
  • UK Data Protection Act 2018 compliant
  • Swiss revFADP compliant
  • CCPA / CPRA compliant (California)
  • VCDPA compliant (Virginia)
  • CPA compliant (Colorado)
  • CTDPA compliant (Connecticut)
  • TDPSA compliant (Texas)
  • OCPA compliant (Oregon)
  • MCDPA compliant (Montana)
  • FDBR compliant (Florida)
  • ICDPA compliant (Iowa)
  • ICDPA compliant (Indiana)
  • TIPA compliant (Tennessee)
  • DPDPA compliant (Delaware)
  • NJDPA compliant (New Jersey)
  • NHDPA compliant (New Hampshire)
  • NDPA compliant (Nebraska)
  • MCDPA compliant (Minnesota)
  • MODPA compliant (Maryland)
  • KCDPA compliant (Kentucky)
  • RIDTPPA compliant (Rhode Island)
  • Canada PIPEDA compliant
  • Quebec Law 25 compliant
  • Alberta PIPA compliant
  • British Columbia PIPA compliant
  • Singapore PDPA compliant
  • Hong Kong PDPO compliant
  • Brazil LGPD compliant
  • Japan APPI compliant
  • Australia Privacy Act / APPs compliant
  • India DPDPA 2023 compliant
  • Thailand PDPA compliant
  • Malaysia PDPA 2010 (as amended 2024) compliant
  • New Zealand Privacy Act 2020 compliant
  • South Africa POPIA compliant
  • UAE PDPL compliant
  • Mexico LFPDPPP compliant
  • Kenya Data Protection Act 2019 compliant
  • Ghana Data Protection Act 2012 compliant
  • Nigeria NDPA 2023 compliant
  • Indonesia PDP Law 2022 compliant
  • Philippines Data Privacy Act 2012 compliant

Global Fiscal & E-Invoicing

  • EN 16931 - EU e-invoicing core standard
  • UBL 2.1 - Universal Business Language
  • Austria - RKSV
  • Belgium - Peppol BIS 3.0 (B2B)
  • Czechia - fiscalization
  • Croatia - Fiscalization 2.0
  • Denmark - Peppol BIS 3.0 (B2B)
  • France - NF525 / LNE / Infocert, Factur-X / PDP, E-Reporting
  • Germany - KassenSichV / TSE, DSFinV-K, GoBD, E-Rechnung B2B (XRechnung / ZUGFeRD)
  • Hungary - Online Szamla
  • Italy - Scontrino, FatturaPA (via SDI)
  • Lithuania - i.SAF / i.MAS
  • Norway - Peppol BIS 3.0 (B2B), SAF-T
  • Poland - KSeF
  • Portugal - ATCUD/QR, SAF-T PT
  • Slovakia - eKasa
  • Slovenia - fiscalization (davcno potrjevanje)
  • Spain - FacturaE, SII, VeriFactu, TicketBAI
  • Sweden - SKVFS (certified cash registers)
  • Argentina - ARCA (Q4 2026)
  • Australia - Peppol PINT A-NZ (Q4 2026)
  • Brazil - NFe, NFCe, NFSe (Q4 2026)
  • Chile - SII Chile (Q4 2026)
  • Colombia - DIAN (Q4 2026)
  • Finland - Finvoice, TEAPPSXML (Q4 2026)
  • Japan - JP PINT (Peppol) (Q3 2026)
  • Malaysia - Peppol Malaysia (Q4 2026)
  • Mexico - CFDI (Q4 2026)
  • New Zealand - Peppol PINT A-NZ (Q4 2026)
  • Peru - SUNAT (Q4 2026)
  • Romania - Peppol (RO e-invoice) (Q4 2026)
  • Saudi Arabia - ZATCA (Q4 2026)
  • Singapore - Peppol BIS 3.0 (Q4 2026)
  • United Arab Emirates - Peppol (5C) (Q4 2026)

Standards & Frameworks

  • Cyber Essentials Certified
  • SOC 2 Type II - audit in progress
  • ISO/IEC 27001 - audit in progress
  • NIST Cybersecurity Framework - aligned
  • NIST Privacy Framework - aligned
  • NIST SP 800-53 / 800-63 / 800-63B - aligned
  • NIST AI Risk Management Framework - aligned
  • CIS Critical Security Controls / CIS Benchmarks - aligned
  • OWASP ASVS & OWASP Top Ten - aligned
  • ISO 25010 (quality) - aligned
  • ISO 31000 (risk) - aligned
  • ITIL - aligned
  • W3C Web Standards - aligned
  • OpenAPI Standard - aligned
  • DevSecOps practices - aligned
  • ePrivacy Directive - aligned
  • EU Whistleblowing Directive (2019/1937) - aligned

Payments Compliance

  • PCI DSS Level 1
  • PSD2 / Strong Customer Authentication
  • 3D Secure (3DS)
  • EMVCo Level 1 & 2
  • AML / KYC controls
  • Sanctions screening (OFAC, UN, EU, HMT)

International Data Transfer Mechanisms

  • EU-US Data Privacy Framework
  • EU Standard Contractual Clauses (Decision 2021/914) - Modules 2 & 3
  • UK International Data Transfer Agreement (IDTA) + ICO Addendum
  • Swiss FDPIC-recognised transfer mechanisms
  • APEC Cross-Border Privacy Rules (CBPR)

Accessibility Compliance

  • ADA (Americans with Disabilities Act) - aligned
  • European Accessibility Act (EAA) 2025 - aligned
  • WCAG 2.2 - aligned
  • EN 301 549 - aligned
  • WAI-ARIA - aligned

Una piattaforma per hotel, spa, corsi, eventi e ristoranti.

Tiquo Ltd
Londra, UK

LinkedInTop Performer Spring

Utilizziamo i cookie

Puoi accettare o rifiutare i cookie per analisi e pubblicità. Se chiudi questo avviso, li rifiuti.

Scopri di più