Important - FAQ - Push to Google UPP Upgrade
TABLE OF CONTENTS
- 1. Why is a new SDK upgrade in 2026?
- 2. What happens if I don’t upgrade the SDK?
- 3. Which customers are impacted?
- 4. What are the key deadlines?
- 5. What are my upgrade options?
- 6. When is Entrust Professional Services required?
- 7. How long does an Entrust-led upgrade take?
- 8. Who delivers the SDK upgrade?
- 9. I need to perform the PGP key exchange for Google OPC. How should I proceed?
- 10. Do I need a project for the PGP key exchange?
1. Why is a new SDK upgrade in 2026?
Google is introducing changes to its Push Provisioning framework that require an SDK upgrade and introduce additional capabilities:
- Unified Push Provisioning (UPP) API migration – enables support for Google's new Push Provisioning API
- Google OPC – supports the Google UPP credential required for the Google Account experience.
- Bounce Provisioning – allows a provisioning journey initiated from Google Wallet and redirected to the issuer application. Google currently recommends, rather than requires, this capability for UPP migration.
- Google Wearables – enables card provisioning to supported Google wearable devices and is optional where the issuer's scope is limited to handheld devices.
Google requirement / capability | Indicative Status | Indicative Due date | Customer impact / action | Min SDK version |
Google UPP Migration | Mandatory | December 31, 2026 | Upgrade to the supported Entrust SDK and migrate to UPP. | 2.8.1-10 |
Google OPC | Mandatory | Q1 2027 | Enable Google OPC and complete the required key exchange. | 2.8.6 |
Bounce Provisioning | Recommended | No mandatory deadline | Implement if the Google Wallet-to-issuer app flow is required. | 2.8.5 |
Google Wearables | Optional | No mandatory deadline | Implement if provisioning to supported wearables is required. | 2.8.6 |
Note: The dates and mandatory/optional status above reflect the information currently available to Entrust. Customers should confirm applicable Google requirements and deadlines directly with Google
2. What happens if I don’t upgrade the SDK?
If you are using an SDK version that does not support Google's new requirements:
- Your existing Google Push Provisioning implementation may no longer be compatible with Google's supported APIs after the migration deadline.
- You may not meet Google's UPP requirements.
- You will not be able to support capabilities requiring newer Entrust SDK versions, including Google OPC
3. Which customers are impacted?
You are impacted if you use:
- Push to Google Wallet with Full or Light SDK (Native or Bridge)
4. What are the key deadlines?
- December 2026: All Google Push implementations must migrate to Unified API
- Q1 2027: All Google Push implementations must support Push to Google Account
5. What are my upgrade options?
Depending on your situation:
- Free, customer‑led upgrade (no Entrust PS involvement) - Also see #9 and #10
- Dedicated Entrust Professional Services project
6. When is Entrust Professional Services required?
Professional Services are recommended if:
- You are using an older or unsupported SDK version.
Professional Services are required if:
- You want Entrust to support and manage your SDK upgrade. This assistance is delivered through a dedicated Professional Services project.
- The PGP key exchange required for Google OPC has not yet been completed, as the key exchange requires Entrust involvement
7. How long does an Entrust-led upgrade take?
The indicative duration for an Entrust-led SDK upgrade project is up to four (4) months, depending on the customer's starting SDK version, scope and readiness
8. Who delivers the SDK upgrade?
- Professional Services: SDK delivery with upgrade support, delivered through a dedicated project.
- Support: SDK delivery only, requested through a FreshDesk ticket. Upgrade assistance is not included
9. I need to perform the PGP key exchange for Google OPC. How should I proceed?
The PGP key exchange required for Google OPC must be handled through an Entrust Professional Services project. The exchange is a prerequisite for Google UPP OPC qualification and production deployment.
To proceed:
- Contact your Entrust Sales representative to request the opening of a project for the Google UPP OPC / PGP key exchange.
- Entrust will generate and securely provide its PGP public key.
- You will register the Entrust public key with Google and complete the required Google-side configuration.
- Once completed, provide the corresponding Google key back to Entrust.
- Entrust will complete the required DCS configuration and support validation of the encrypted data exchange
Important: Even if you are performing the SDK upgrade yourself, a Professional Services project is still required if the PGP key exchange with Entrust has not yet been completed.
10. Do I need a project for the PGP key exchange?
- Yes. A Professional Services project is generally required. If you already have an active project, the PGP key exchange may be covered by its existing scope, subject to a case-by-case review.
- Exception: For issuers with a Google-approved OPC waiver, Support can handle the PGP key exchange without a project. SDK upgrades are excluded. /!\ Google OPC will be enforced in Q1 2027