Install the Kemicard managed package from the Salesforce AppExchange, authorize the backend, and get your org provisioned for Apple Wallet and Google Wallet. Time required: about 45 minutes plus provisioning turnaround. The Kemicard managed package install takes about 15 minutes; this guide shows how to install Kemicard (AppExchange listing) end to end.
Prerequisites
- A Salesforce org (Sales Cloud, Service Cloud, Nonprofit Cloud, NPSP, or compatible) with System Administrator access.
- Your production and sandbox Org IDs — required to provision licenses on the Kemicard backend. If an org is refreshed or changed, the Org ID changes and provisioning must be updated.
- A dedicated integration mailbox for the named credential user. Prefer a shared system-admin mailbox with non-expiring credentials over a personal account — this address also receives system alerts.
- A decision on which production user acts as the integration user. Enrollment emails send from this identity, so choose a branded, monitored address.
Step 1 — Locate Kemicard on the Salesforce AppExchange
The installation begins at the official Kemicard listing on the Salesforce AppExchange, the official marketplace for Salesforce applications.
- Navigate to the Kemicard listing on the Salesforce AppExchange.
- Click Get It Now and log in with your Salesforce or Trailblazer account.
- Confirm your details and select the checkbox to agree to the terms and conditions.
- Initiate the external installation: click Visit Provider. This redirects you to the provider's official installation website, where the installation process is managed.
Step 2 — Select the product and the installation plan
Clicking Visit Provider takes you to the Kemisoft installation portal at install.kemicard.app. Two choices are made here before Salesforce is touched at all: which product, and which plan.
- Select the product for Salesforce: on the installation landing page, click “Kemicard digital wallet membership pass for Salesforce” to confirm you are installing the correct integration for your Salesforce instance. The version number shown here is the one you will install.
- Choose a plan. The installer offers two, and the difference matters:
- Install with Sample Data (New Installs Only) — the core package plus Contact metadata, permission sets and optional sample data, giving you a fully configured org to explore. This is the right choice for a first evaluation.
- Install Package Only (New Installs or Upgrades) — the core package alone. Your existing data and configuration are preserved, so this is the choice for upgrading an org that already runs Kemicard.
- Click the plan you want. For a first-time sandbox evaluation, choose Install with Sample Data.
Step 3 — Choose the environment (sandbox recommended)
Click Log In at the top right of the installer and pick where the package should go: Production or Developer Org, Sandbox or Scratch Org, or Use Custom Domain if your org logs in through a My Domain URL.
We highly recommend a Sandbox or Scratch Org for your initial evaluation. Beyond standard testing best practice, the installation creates unpackaged metadata (custom fields, settings, logs) that remains in the org even after the package is uninstalled. Testing in a sandbox keeps production clean and avoids tedious manual cleanup of these auxiliary components later.
Step 4 — Sign in and authorize the installer
- Enter the username and password for the org you selected.
- Complete any multi-factor prompt your org enforces.
- Grant permissions: click Allow so the installer can deploy on your behalf.
Step 5 — Validate, then install
After you sign in and authorize, you are returned to install.kemicard.app, which now shows Connected to Salesforce with the user, org and edition you signed in as. Check that line before going further — installing into the wrong org is the most common mistake at this point, and log in with a different org is right there if it is wrong.
- Click Start Pre-Install Validation. This inspects the target org and reports problems before anything is deployed, so a failed check costs you nothing.
- When validation reports completed successfully, click Install to begin deployment. The installer will log you out after a period of inactivity, so start the install within a few minutes of validating.
Once the process initiates, you can click “view” or open a new window to access the Salesforce org where Kemicard is being installed.
Step 6 — Verify the installation
- In your Salesforce sandbox, click Setup to open the configuration menu.
- In the Quick Find search box, enter “installed packages” and click Installed Packages.
- Confirm that Kemicard appears and matches the version number you selected on the portal.
Step 7 — Update the named credential
- In the Quick Find box, enter “Named Credentials” and click Named Credentials.
- Locate and click “Kemicard app” to view its details.
- Click Edit to modify the settings.
- Update the credential details: click the username field and enter the username and password from your credentials email to update the credential securely.
Don't have the credentials? In Kemicard Console › Authorization, click Request Credentials, enter your name, company and business email, and our team will send them to you. You can also use the form below.
- Click Save to apply the changes.
Most “pass URLs not generating” issues are credential or authorization failures here — see Troubleshooting for status-code diagnosis (401 vs 409).
Step 8 — Authorize the Kemicard app
Since Kemicard 2.30 the Console uses the word Authorization throughout, and this step happens on its Authorization page.
The final installation stage authorizes the application inside the Salesforce user interface.
- Open the App Launcher (the grid icon, top left).
- Search for the app: type “Kemicard” in the search box.
- Launch the application: click Kemicard.
- Access the console: click the Kemicard Console tab to open the main management interface.
- Authorize the user: click Authorize Kemicard user to initiate the permission grant.
- Confirm access: you are redirected to a Salesforce authorization page — click Allow to finalize the authorization and complete the installation.
Keeping the connection healthy
Kemicard checks its connection once a day, at 2:00 AM; you don't need to set it up. If the authorization has expired, the Console's Authorization page shows an Action Required warning, and the admin and the integration user receive an email titled [Action Required] Kemicard Connection Expired - Reauthorization Needed. Pass generation and notifications pause until you reconnect: open the Authorization page and click Authorize Kemicard User.
Run upgrade steps and check the Connect Scheduler
- Open Kemicard Console › Upgrades. If upgrade steps are listed, run them. On a new installation the page should read System is Up to Date. Upgrades is available to users with the Kemicard Upgrade Access custom permission, included in the Kemicard Digital Pass permission set.
- Open Kemicard Console › Connect Scheduler and check that it shows Active. The scheduler sends scheduled Kemicard Connect sends and is on by default.
Questions during setup? Contact Support in the Console opens a ticket form with a category, severity, subject and description.
Step 9 — Configure email deliverability
- Verify your sending domain and set up DKIM for production sends.
- In sandboxes and scratch orgs with unverified domains, enable “Use a substitute email address for unverified domains” under Email Deliverability, or provision a DKIM key in DNS for the sandbox.
- Send a test enrollment email to multiple mail providers; check quarantine folders if a trial email doesn't arrive.
Step 10 — Generate your first pass
With installation complete, prove the pipeline end to end: the Getting Started guide walks you through generating and sending your first membership pass, step by step with screenshots — then change a mapped field and watch the installed pass update on a real device.
install.kemicard.app is reached by clicking Get It Now and then Visit Provider, as in Step 1 above — it is not a separate route. Going to the installer directly skips the AppExchange form, so your licence provisioning has nothing to match against.Template Pass configuration — field reference
After installation, open the Template Pass tab. A sample template, Woofly Membership Pass, ships with the package for reference. The key fields:
| Field | What to enter |
|---|---|
| Name | The template pass name |
| Record Type | The record type name |
| Organization Name | Your company name |
| Email Template | API name of the email template used to send Apple passes to users |
| Background Color | RGB value for the pass background |
| Update Email Template | Developer name of the email template used when a Google Wallet pass is updated |
| From Email Address / ID | Sender address for outbound emails and the Organization-Wide Email Address ID |
Google Wallet fields
| Field | Purpose |
|---|---|
| Card Title | Header of the pass — usually the business name. Required; appears in the header row at the very top. |
| Header | The pass title. Required; appears in the title row of the detail view. |
| Subheader | Title label, such as where the pass can be used; appears above the title. |
| Language | Language of pass values. |
| Smart Tap | Conveys data between the device and an NFC terminal. |
| State | Controls display: inactive objects move to the wallet's "Expired passes" section; default is ACTIVE. |
| Logo URL | Shown top-left in the detail view and on the thumbnail; without it, the first letter of the Card Title is used. |
| Detail Banner / Hero Image | Front-of-card imagery, displayed at 100% width. |
Apple Wallet fields
| Field | Purpose |
|---|---|
| Card Title | Text displayed next to the logo. |
| Description | Short description used by iOS accessibility technologies. |
| Expiration / Relevant Date | W3C timestamps (complete date with hours and minutes) controlling expiry and when the pass surfaces. |
| Foreground / Label / Strip Color | CSS-style RGB triples, e.g. rgb(100, 10, 110) — decimals are not supported. |
| Max Distance | Maximum distance in meters from a location at which the pass is relevant. |
| Sharing Prohibited | Removes the Share button on the back of the pass (iOS 11+). |
| Suppress Strip Shine | Displays the strip image without the shine effect (default true). |
| Grouping Identifier | Groups related event tickets/boarding passes in Wallet. |
| Wallet Resource ID | Content Document ID of a zip file containing all pass resources. |
If you installed with sample data, open the Template Pass tab to find the Woofly reference template — the fastest starting point for your own designs:
Open the template to see how the field reference above maps onto a real record — every row in the tables corresponds to a field here:
The Kemicard Configuration record holds org-wide settings, including the email template used for enrollment sends:
A successful authorization confirmation means the org is fully connected and ready to generate passes:
Wire up Flows or Triggers
Two methodologies activate pass generation (full details in the Flow Integration guide and Architecture reference):
- Salesforce Flow — a record-triggered Flow on the relevant object (e.g., Contact) with a decision element, calling the Generate Pass Apex Action with
configurationIdandwhatId(plustemplatePassIdto override the configuration's template binding); capture the returned Pass ID and write it back to the record. - Apex Trigger — call
AppleTemplatePassSFObjectDataService.upsertPassesfrom your trigger handler with a populatedPassRequest. IncludepassIdto update an existing pass instead of creating a new one.
Permission sets & user access
Kemicard ships permission sets that control who can design templates, generate passes, send with Kemicard Connect, scan, and administer the app. Assign them deliberately (names as of Kemicard 2.30):
| Permission set | Typical assignment | What it gives |
|---|---|---|
| Kemicard Digital Pass | Salesforce admins | Full Kemicard administration: Configuration, Authorization, Studio, Kemicard Connect and the Connect Scheduler, and Console › Upgrades through the Kemicard Upgrade Access custom permission |
| Kemicard Digital Pass User | Staff who generate and update passes | Pass generation. Since 2.30 it no longer needs View Setup and Configuration |
Kemicard Connect (formerly Kemicard Pass Campaign Manager; API name Kemicard_Pass_Bulk_Actions) | Non-admins who send with Kemicard Connect, together with Kemicard Digital Pass User | The Kemicard Connect tab, and creating and running Connects |
| Kemicard Template Configuration | Template designers | Editing templates in Kemicard Studio |
| Kemicard Integration | The Kemicard integration user | The connection between Salesforce and the Kemicard service, including the daily connection check |
| Kemicard Scanner | Door and front-desk staff | Scanning passes with the Kemicard Scanner |
| Kemicard Event Admin | Event managers | Event set-up, including Event Assignment |
Users without access to Studio, Upgrades or Event Assignment see a clear “no access” message rather than an error; the Studio and Upgrades messages tell them to contact their System Administrator. The full list of 2.30 permission changes is in the release notes. Object and field access always follows the running user's profile and permission sets — Kemicard never bypasses your sharing model.
Post-install checklist
- Named credential authenticates (generate a test pass URL)
- Email template set on the Configuration and a test enrollment email delivered
- Test pass installed on a physical iPhone and Android device
- Field change on the test record refreshes the installed pass
- Push notification received on both platforms
- Permission sets assigned to admin, staff, Connect and scanner users
- Console › Upgrades shows no pending steps, and Console › Connect Scheduler shows Active
- Sandbox Org ID and production Org ID recorded with your account manager
Installation FAQ
- Do upgrades require reinstalling? No — upgrades install as new managed package versions over the top, preserving your templates and configuration.
- Can we install in a scratch org? Yes, for development. Note the email deliverability caveats above for unverified domains.
- Does a sandbox refresh break anything? A refresh changes the sandbox Org ID, so backend provisioning must be re-aligned — contact support with the new Org ID before testing resumes.
- What network access does the org need? Only outbound HTTPS from Salesforce to the Kemicard backend via the named credential; there are no inbound connections into your org.
Sources: Salesforce Help: Install a Managed Package; Named Credentials; Servers and IDs (sandbox Org IDs); Apple's Pass reference (the pass.json keys behind the Apple Wallet fields).
