Generate and update Apple Wallet and Google Wallet passes directly from a Salesforce Flow — no custom code required. Based on the Kemicard Apex Action & Custom Configuration Guide (Kemicard v2.27, May 2026).
Overview
Kemicard exposes an Apex Invocable Action for Flow, plus two additional configuration surfaces beyond Kemicard Studio:
- Kemicard Console → Configuration — controls pass generation behaviour per object (whether to send an email, which wallet platforms to enable).
- Template record settings — pass-level design properties (restricting pass sharing, suppressing the strip shine effect) not exposed in the Studio builder.
Permission sets & access
Kemicard ships seven permission sets (see the permission set reference) that control access to different parts of the package — assign by role; no custom profile changes are required. A single user can hold multiple sets when their role spans areas (e.g., Kemicard Digital Pass User plus Kemicard Template Configuration).
Finding the action in Flow Builder
- Open Setup → Flows and open (or create) your Flow.
- Add an Action element.
- Search for "Generate Pass" or filter the category to Apple Pass.
- Select Generate Pass from list of String as pass details.
- Map the input and output variables below.
Two inputs do almost all the work. configurationId points at the Configuration record that holds the field bindings and email settings; whatId is the record the pass is generated from.
configurationId is the one that matters; doNotCreateAppleWalletPass and doNotCreateGoogleWalletPass let you suppress one platform.
whatId is whichever object you want to generate the pass from and send the email to. Store the output — that is the new Pass record Id.configurationId: for most flows you only need to provide configurationId and whatId — everything else is read from the Configuration record automatically.Return value — and why you should save it
The action returns a Text value containing the Salesforce record ID of the created or updated Pass. Store it in a Text variable (e.g., PassId) and write it back to your object with an Update Records element. Storing the Pass ID lets future flow runs detect that a pass already exists and perform an update (including push notifications) instead of creating a duplicate.
Update & Notify. When one change both updates a pass and sends a notification, Pass Generation Requests record it with a single request type, Update & Notify (Kemicard 2.30), so it is clear both happened.
Example flow patterns (shipped with the package)
Five example flows ship as unmanaged metadata when you select the Sample Data option during install. They form a deliberate hierarchy: Send Membership Pass is the core flow that invokes the Apex Action; every other entry point calls it as a subflow, keeping pass-generation logic in one place.
| Flow | Type | What it demonstrates |
|---|---|---|
| Send Membership Pass (core) | Autolaunched | Invokes the Apex Action. Accepts an optional ConfigurationId; when blank, it falls back to reading the configuration from the Contact's linked template — reusable across template setups. |
| Send Membership Pass From Checkbox | Record-triggered (Contact, after save) | Fires when Send_Membership_Pass__c changes to true; delegates to the core subflow, then resets the checkbox so subsequent saves don't create duplicate passes. |
| ContactMessagingScreenFlow | Screen flow | Staff-facing UI to send a pass or message from a Contact record. |
| Update Contact Google and Apple Wallet URL | Autolaunched | Writes the generated wallet URLs back onto the Contact for use in emails and portals. |
| Kemicard Expired Member Scan Processor | Autolaunched | Handles scans of expired members — the pattern for scan-driven automation. |
Building a Configuration, step by step
A Configuration is what configurationId resolves to, and it is created through a step-by-step wizard in Kemicard Console → Configuration (open an existing one with Show actions › Edit). Each step decides one thing.
Last step: Email & Date Fields. The email field the enrollment message goes to, plus the Relevant Date Field and Expiration Date Field. Save & Finish writes the Configuration. Since Kemicard 2.30 each date field in these dropdowns is labelled [Date] or [Date/Time], with a note on the default time for date-only fields: a date-only expiration lasts to 23:59:59 UTC that day, and a date-only relevant date starts at 00:00:00 UTC. Date/Time fields keep their exact time.
Every template on the configuration reads these fields, so each person's pass carries their own dates. To check them for a real record, or to fix one date for every pass from a template, see pass dates in Kemicard Studio.
Template-level settings (not in the Studio)
- Apple Wallet — advanced: sharing prohibited, suppress strip shine, grouping identifier, max distance, label/strip colors (strict
rgb(R, G, B)format — no decimals). - Google Wallet — advanced: Smart Tap (NFC terminal data), state handling (inactive objects move to "Expired passes"), hero/detail imagery.
- Shared: relevant date, expiration date, from-address settings.
Reference screens
Related: Architecture & upsertPasses · API Reference · Kemicard Connect
Kemicard with Salesforce Marketing Cloud
Passes slot into Marketing Cloud journeys as both a channel and a trigger. The common patterns:
- Issue on journey entry — when a contact enters a welcome or renewal journey, a Flow (fired from the journey's Salesforce activity) generates the pass and sends the enrollment email, so the add-to-wallet link rides your existing journey emails.
- Push as a journey step — use pass push notifications alongside email and SMS: a lock-screen message for the time-sensitive touch, email for the detail. The pass channel has no per-message cost.
- Engagement data back to journeys — installs, scans, and check-ins land on the Salesforce record, where journey entry criteria and decision splits can read them: re-target members whose pass isn't installed, or branch on event attendance.
Sources: Salesforce Developers: InvocableMethod Annotation (Apex Developer Guide); Salesforce Help: Triggered Flows and Marketing Cloud Connect; Google's Expired Generic passes.
