Wavelynx vs Hid

Structural diff of the google · issuance flows. Steps are aligned by their semantic equivalenceKey; the center column surfaces deltas in envelope kinds, actor kinds, and trust crossings. Hover any row to focus it.

google · issuance22 vs 15 steps

Wavelynx — Google Wallet issuance

22 steps5 envelopes

Diff

4Aligned

0Identical

18Only A

11Only B

HID — Google Wallet issuance (Android)

15 steps3 envelopes

1Partner → Wavelynx
POST /provisioning (display, role, photo, group_id)
TLS
Trust boundary
Partner POSTs provisioning request to credential provider
from actor kind: partner → serviceenvelopes: [TLS] → [none]trust crossing: yes → no
1Guardian → AE NFC Cloud
Admin issuance request (per-user or bulk)
2Wavelynx → NXP MIFARE2GO
Create digitization reference
mTLS
Trust boundary
CP creates a digitization reference at a wallet mediator (e.g. NXP)Only in wavelynx
—
3NXP MIFARE2GO → Wavelynx
digitization reference + correlationId
mTLS
Mediator returns a digitization reference + correlation idOnly in wavelynx
—
—
CP assembles signed provisioning bundleOnly in hid
2AE NFC Cloud → HID Origo
POST /passes — create Pass for GOOGLE_WALLET
mTLS
Trust boundary
4Wavelynx → Wavelynx
Persist credential record (status PENDING)
CP persists credential record in PENDING state
from actor kind: service → platformto actor kind: service → platform
3HID Origo → HID Origo
Generate issuance token · associate with user
5Wavelynx → Partner
201 Created (vuid + Google add-to-wallet link)
TLS
CP returns Add-to-Wallet link or token to partnerOnly in wavelynx
—
6End-user device → Google Wallet
User initiates Add to Google Wallet
User taps Add to Wallet on deviceOnly in wavelynx
—
7Google Wallet → NXP MIFARE2GO
Add-to-Wallet request (digitization reference)
Wallet platform fetches provisioning bundle from CPOnly in wavelynx
—
8NXP MIFARE2GO → Wavelynx
GET fetchCardPayload / fetchCardMetadata (by correlationId)
mTLSJWE
Trust boundary
Only in wavelynx
—
9Wavelynx → Google Cloud KMS
Decrypt master keyset for partner site
KMS-wrap
KMS unwraps master keyset for the credential providerOnly in wavelynx
—
10Google Cloud KMS → Wavelynx
Master keyset (memory only, not persisted)
KMS-wrap
KMS returns keyset plaintext into memory (never persisted)Only in wavelynx
—
11Wavelynx → Wavelynx
Diversify per-credential key, JWE-encrypt
Derive per-credential key from a master keyOnly in wavelynx
—
12Wavelynx → Wavelynx
Assemble bundle — DESFire EV2 profile, JWE-wrapped keys, pass display fields
CP assembles signed provisioning bundleOnly in wavelynx
—
13Wavelynx → NXP MIFARE2GO
Encrypted payload
mTLSJWE
CP delivers provisioning bundle to wallet platformOnly in wavelynx
—
—
CP returns an issuance token the device-side SDK will redeemOnly in hid
4HID Origo → AE NFC Cloud
Pass passId + issuance token
mTLS
—
CP / partner delivers a redemption invitation to the userOnly in hid
5AE NFC Cloud → User
Send invitation email (redemption link + temp credentials)
—
User signs in to the app (email + password / SSO / invitation cred)Only in hid
6User → AE Wallet App
User opens AE Wallet App on Android device · signs in
—
Partner authenticates and requests a bearer tokenOnly in hid
7AE Wallet App → AE NFC Cloud
POST /authenticate/verify
TLS
Trust boundary
—
App persists auth token to OS keystore and enables biometric unlockOnly in hid
8AE Wallet App → AE Wallet App
Save token to Android Keystore · enable biometric
—
User taps Add to Wallet inside the credential-management appOnly in hid
9User → AE Wallet App
User taps "Add to Google Wallet"
—
Device-side SDK invokes setupEndpoint to begin pass installationOnly in hid
10AE Wallet App → HID Origo Android SDK
createInitializedMobileKeysManager · setupEndpoint(target .googleWallet)
—
Device-side SDK invokes setupEndpoint to begin pass installationOnly in hid
11HID Origo Android SDK → HID Origo
Redeem issuance token
mTLS
Trust boundary
14NXP MIFARE2GO → Google Wallet
Credential payload
Mediator / SDK pushes the credential into the wallet platform
kind: response → requestfrom actor kind: mediator → platformenvelopes: [none] → [mTLS]trust crossing: no → yes
12HID Origo → Google Wallet
Push Seos credential to Google Wallet
mTLS
Trust boundary
15Google Wallet → End-user device
Deliver and provision pass on device
Wallet platform installs credential on device
kind: async-event → responseto actor kind: device → serviceenvelopes: [none] → [mTLS]
13Google Wallet → HID Origo Android SDK
Pass provisioned on device
mTLS
16End-user device → Google Wallet
Provisioning confirmation
Device confirms provisioning to wallet platformOnly in wavelynx
—
17Google Wallet → NXP MIFARE2GO
Status update
Wallet platform notifies its mediator (NXP / HID Origo) of a lifecycle eventOnly in wavelynx
—
18NXP MIFARE2GO → Wavelynx
POST cardStatusChanged (status ACTIVE)
mTLS
Trust boundary
Wallet sends webhook with provisioning outcomeOnly in wavelynx
—
19Wavelynx → Wavelynx
Update credential status → ACTIVE
Internal: PENDING → ACTIVE state transitionOnly in wavelynx
—
20Wavelynx → Partner
Webhook (status ACTIVE)
x-api-key
Trust boundary
CP notifies partner that credential is ACTIVEOnly in wavelynx
—
21Wavelynx → NXP MIFARE2GO
200 OK (synchronous response to NXP)
mTLS
CP acks wallet platform's bundle fetchOnly in wavelynx
—
22Partner → Wavelynx
200 OK (webhook acknowledged)
x-api-key
Partner acks CP's webhook deliveryOnly in wavelynx
—
—
App reports back to CP that the credential was successfully issuedOnly in hid
14AE Wallet App → AE NFC Cloud
api/mobilecred/card/save (mark issued)
TLS
—
CP updates internal credential lifecycle statusOnly in hid
15AE NFC Cloud → HID Origo
Status confirmation
mTLS

Hover a row to focus.

Identical structureStructural deltaOnly in wavelynxOnly in hid

Source

src/wallet-api-data-flow-architecture-v1.0.12.pdf — §6.2 Issuance flow
src/Architecture & Sequence Diagrams/Google Wallet Integration Overview.pptx — Admin-Initiated Credential Provisioning slide
src/web/hid-origo-api/04-credential-management.md — Credential Management v3.x · platformType GOOGLE_WALLET
src/Architecture & Sequence Diagrams/HID Android Issuance.jpg

The AE Mobile Wiki needs a bigger screen.