application/vnd.apple.pkpass MIME Type Reference

Application

application/vnd.apple.pkpass

Basic information

Type	application
Subtype	vnd.apple.pkpass
Structured suffix	None
File extensions	.pkpass
Category	Application
Standard	IANA media type registry or common platform registration

MIME anatomy

application/vnd.apple.pkpass has a top-level type of application and a subtype of vnd.apple.pkpass. The top-level type tells clients the broad handling model, while the subtype identifies the exact format, codec family, document type, or container.

Part	Value	What to check
Top-level type	`application`	Controls broad behavior such as text rendering, image decoding, download handling, or multipart parsing.
Subtype	`vnd.apple.pkpass`	Should match the real file format, not only the filename extension.
Structured suffix	`None`	No structured suffix is declared for this type.
Charset	`Binary`	Do not add a charset parameter to binary payloads.
Binary payload	Yes	Treat the body as bytes and avoid text transformations.

HTTP header

Content-Type: application/vnd.apple.pkpass

BinaryEncodingYesBinary.pkpassExtensions

Common use

Use application/vnd.apple.pkpass in Content-Type and Accept headers when serving or requesting Apple Wallet pass. Correct MIME types help browsers, APIs, uploads, and download workflows handle files safely and predictably.

Browser support depends on the media type and the feature using it. Browsers can download almost any MIME type, but only selected text, image, audio, video, font, and document types are rendered natively.

For uploads, do not trust the file extension alone. Check the declared MIME type, validate the file signature when security matters, and store the original extension separately from the trusted server-side classification.

Browser and API behavior

Context	How application/vnd.apple.pkpass is used	Practical check
HTTP response	Send `application/vnd.apple.pkpass` so clients choose the right parser or renderer.	Inspect the Network panel and confirm the response header, not just the file extension.
HTTP request	Use `Accept: application/vnd.apple.pkpass` when an API can return several formats.	Return `406 Not Acceptable` or a documented fallback when the type is unavailable.
Upload form	Use file extension and declared MIME type as hints.	For risky uploads, verify magic bytes or parse the file before trusting it.
Storage	Store the trusted MIME classification separately from the original filename.	This keeps later downloads correct even if a user uploads a misleading name.

Common mistakes

Serving binary content as application/octet-stream when the browser or API client expects application/vnd.apple.pkpass.
Assuming .pkpass proves the file is safe. Extensions are user-controlled and should be treated as hints.
Adding a charset parameter to binary content. Binary formats should normally be sent without charset.

HTML download

<a href="/download.pkpass" download type="application/vnd.apple.pkpass">Download file</a>

fetch Accept header

fetch("/api/file", {
  headers: { Accept: "application/vnd.apple.pkpass" }
});

multer upload filter

const upload = multer({
  fileFilter: (req, file, cb) => cb(null, file.mimetype === "application/vnd.apple.pkpass")
});

Express response

app.get("/file", async (req, res) => {
  res.setHeader("Content-Type", "application/vnd.apple.pkpass");
  res.send(await readFile("example.pkpass"));
});

Flask response

from flask import send_file

@app.get("/file")
def file():
    return send_file("example.pkpass", mimetype="application/vnd.apple.pkpass", as_attachment=False)

Go net/http response

func handler(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "application/vnd.apple.pkpass")
    http.ServeFile(w, r, "example.pkpass")
}

Nginx type mapping

types {
    application/vnd.apple.pkpass pkpass;
}
default_type application/octet-stream;

curl negotiation

curl -H "Accept: application/vnd.apple.pkpass" https://example.com/file.pkpass

Validation checklist

Check	Recommended handling
Declared type	Compare the uploaded or generated MIME value with `application/vnd.apple.pkpass` when this exact format is required.
Extension	Accept .pkpass only as a convenience signal, not as proof of content.
Signature or parser	Validate the binary signature or parse the container when untrusted users can upload files.
Download safety	Set `Content-Disposition` deliberately when the file should download instead of render inline.
Caching	Use cache headers that match the file lifecycle, especially for generated assets and user uploads.

application/vnd.apple.pkpass