Issue, Deliver, and Update Wallet Passes From Salesforce and the Tools Built Around It
Salesforce stays your single source of truth. Kemicard runs inside the org as a connected app and hands a signed add-to-wallet link to whatever channel you send from. There is no sync job and no separate database to keep current. The record changes in Salesforce, the pass changes in the wallet.
Try on AppExchangeEverything Kemicard Connects To
Salesforce CRM (system of record) → Connected App → Kemicard (engine) → API and webhooks → Email · SMS · Web · Scan → signed and pushed → Apple and Google Wallet.
Salesforce setup
Connected App, OAuth 2.0, AppExchange install.
Email platforms
Mailchimp, Klaviyo, Brevo — plus Salesforce email templates.
SMS delivery
Twilio and any SMS API, including MessageBird and Vonage.
API & webhooks
HubSpot, other CRMs, POS, and custom apps over REST.
Apple Wallet
.pkpass, certificates, APNs push — managed for you.
Google Wallet
Wallet API, JWT signing, pass classes and objects.
Scanner & check-in
Experience Cloud pages, NFC, and barcode scanning.
Ecosystem partners
Blackthorn Events, Fundraise Up, StoreConnect, Nintex DocGen, TinyURL.
Install From AppExchange and Authorize One Connected App With OAuth 2.0
- Managed package — install in a sandbox first, then production. Upgrades install as new package versions, with no rebuild.
- Governed from Setup — assign access through profiles and permission sets, and manage OAuth policies and IP relaxation from Setup. Object and field access follows the running user's permissions.
- OAuth 2.0 authorization — a one-time approval grants only the API scopes you approve, such as
apiandrefresh_token. Revoke the refresh token anytime from Connected Apps OAuth Usage. - Pass data stays on the record — no external database, no sync job. Each pass is populated from the record's fields, keeping one source of truth behind every integration on this page.
Send Passes Through the Email Platform Your Team Already Uses
Kemicard writes a signed add-to-wallet link to a field on each Salesforce record. Sync that field into your ESP, then point a button block at it. One link resolves to Apple Wallet or Google Wallet based on the recipient's device.
- Mailchimp — sync the link into a merge field and reference its merge tag in any campaign or Customer Journey.
- Klaviyo — store the link as a profile property; a welcome flow delivers the loyalty card, a VIP tier update re-sends the current pass.
- Brevo — map the link to a contact attribute; one attribute and one button block put the pass in production.
- Any ESP via API — call the Kemicard REST API for a signed link per recipient and inject it at send time.
Send Digital Membership Cards Over SMS With Twilio, or Any Gateway That Accepts an API Call
A Salesforce Flow calls the Twilio Programmable Messaging API with the signed add-to-wallet link merged into the message body. The recipient taps the link and the pass installs by device. The Flow runs inside your org, so no records leave Salesforce to send the text.
- Twilio delivery — the sender number and messaging compliance settings stay on your Twilio account.
- Signed short links — each link is scoped to one record and resolves to the recipient's device, Apple or Google.
- Trigger-bound texts — when a points balance or tier field changes, a record-triggered Flow pushes the pass update and sends the SMS.
- Any gateway — MessageBird, Vonage, or any SMS API can send the same link.
Issue a Wallet Pass From HubSpot, a POS, or Any System With a REST API
Send an authenticated POST to the passes endpoint with a record ID and a template, and the response returns a signed add-to-wallet URL. The same endpoints update or revoke a pass by its ID.
- HubSpot workflows — add a “Send a webhook” action and POST the contact's ID. Salesforce remains the system of record.
- REST endpoints — issue, update, revoke, and query, authenticated with a bearer token over HTTPS.
- Webhooks — subscribe an endpoint to
pass.installed,pass.scanned,pass.updated, andpass.removedevents. - Built for what's next — the endpoint that issues a HubSpot pass today issues from a POS or booking engine tomorrow. No per-platform connector to license.
Members Add Their Card From an Experience Cloud Page, and Every Scan Posts Back to Salesforce
- Experience Cloud delivery — add the add-to-wallet button to any page as a Lightning component. Authenticated members see their own card, and each install writes back to their Contact.
- Wallet pass scanner — scan the barcode from any phone camera or handheld reader. Each scan creates a check-in record with the time and method.
- NFC support — where the reader and pass support NFC, members tap to check in. QR and barcode cover every other device.
- Check-in intelligence — attendance and visit frequency report through your existing dashboards. Build the report once and reuse it across events.
Proven Salesforce-Ecosystem Integrations
- Blackthorn Events — registration creates the attendee, Kemicard emails the pass, the Blackthorn app scans it, and the attendee is checked in.
- Marketing Cloud — trigger pass creation and notifications from journeys and campaigns. The wallet pass gives every Marketing Cloud journey a persistent presence in the member's wallet — more channels activated, higher engagement, stronger retention.
- AC MemberSmart (Advanced Communities) — proven pairing for membership communities built on Experience Cloud.
- Fundraise Up & StoreConnect — connect giving and commerce flows to wallet passes.
- Nintex DocGen — generate personalized membership letters and certificates alongside the digital card.
- TinyURL — branded short links for SMS/WhatsApp distribution, configured on your account.
- Carahsoft — public sector distribution and procurement.
Every Integration Runs on One Salesforce-Native Engine
Email, SMS, the REST API, and the scanner all issue passes from the same Salesforce records through the same managed package. One engine to configure, and one to maintain.
Build once, maintain in one place
The wallet infrastructure is already built, and it installs as a managed package.
- No .pkpass signing or Google Wallet JWT to build
- Upgrades arrive as new AppExchange package versions
- No per-platform connector to license or host
One record drives every pass
The Salesforce record is the source. Every channel reads the same value, so nothing drifts out of sync.
- Apple and Google passes update from one field change
- Scan and install events write back to the Contact
- No exported copy sitting in an ESP
Your automation manages passes
The Flows and campaigns your team already runs can issue and update passes.
- Issue from a record-triggered Flow, email, SMS, or API
- Revoke or expire a pass from the same record
- Webhooks push pass events to downstream systems
Wallet Pass Integration FAQs
Answers on connecting Kemicard to your email, SMS, CRM, and wallet tools.
No. Map the fields in the Kemicard config and issue the pass from a record-triggered Flow. Merging the add-to-wallet link into your ESP or Twilio is a config step too. The REST API is there when you want it, but Apex is not required.
Standard and custom objects both work. Contacts, Leads, Campaigns, and Opportunities are common sources, and a custom object like Membership__c works the same way. The pass reads whichever fields you map on that object.
Only the add-to-wallet link. Kemicard writes a signed link to a field on the record, and that field value is what syncs to your ESP audience or merges into a Twilio message. The pass data stays on records in your Salesforce org.
Treat the link like the card itself. It is signed and record-specific, and each pass carries a unique identifier that supports validation at check-in. If a link is shared, revoke or reissue the pass from the Salesforce record.
Yes. Every channel issues from the same Salesforce record through one managed package, so email, SMS, an Experience Cloud page, and the door scanner can all run together. The same pass and the same live data drive each one.
Yes. Install the managed package in a Salesforce sandbox, connect your test tools, and validate the full flow before you promote to production. The AppExchange install supports the standard sandbox-first path.
Re-send the same add-to-wallet link, and the member reinstalls the current pass. Because the pass is generated from the Salesforce record, it returns with the latest field values, so nothing needs to be rebuilt.
Bring Your Stack. We Will Map the Integration Path.
Book 30 minutes with the Kemicard team. We will look at your Salesforce org and the tools around it, then map the exact path to issue and deliver a pass.