Same question. Interfaces from @types/applepayjs say that we still get one token from onpaymentauthorized. So it seems that second option is viable. Or maybe onvalidatemerchant and onpaymentauthorized would be called for each merchant separatelly. Not clear from the docs. It would be good to get anwer from Apple.