Deploying an issuer-specific widget to a wallet container on a client device is accomplished by configuring a widget to provide access to an issuer-specific service group of services that are accessible in a service tier of a multi-tier platform for providing secure transactions, determining service-provider specific resource access requirements for operating the widget, configuring a widget descriptor with the access requirements, and communicating with wallet container to ensure successful deployment of the configured widget that meets the access requirements in the widget descriptor.