New York’s ‘Excelsior Pass’ could cost up to $27 million.

New York’s digital vaccine app, the Excelsior Pass, will likely cost far more than originally expected, with projected costs nearing $27 million, according to newly obtained documents shared with The New York Times.

The pass is stepping into the spotlight this week as restaurants, museums, gyms and other indoor venues in New York City are asking customers — often for the first time — to show proof of at least one vaccine dose as part of a new city mandate.

More than 3.5 million people have already retrieved an Excelsior Pass, which consists of a QR code that can be stored on a smartphone or printed out, the state said. The app verifies applications against city and state vaccination records, and the code is generated the day after someone is considered fully vaccinated, which is 15 days after the final shot.

Through a Freedom of Information Request, the Surveillance Technology Oversight Project, an advocacy group that has expressed concern about the privacy and security implications of vaccine passports, received the latest contract between the state and I.B.M., which is developing the app.

In June, the advocacy group provided The Times with the original version of the contract between the state and I.B.M., which estimated the total cost of the project would be $17 million over three years. Even that was far more than the $2.5 million in development costs that Mr. Cuomo and his staff had publicly mentioned when announcing the arrival of the nation’s first government-sponsored digital app that verifies proof of vaccination.

The updated version of the contract, signed by the state’s Office of Information Technology Services in late June, adds up to another $10 million. New York, the contract states, had already incurred an extra $656,421 in charges for technical support and updates. And a Phase 2 of the project, which was mentioned but not described in detail in the original contract, ended up costing more than double than estimated, rising to $4.7 million from $2.2 million.

“We always said that Excelsior Pass would be a high-tech distraction from real public health measures, but we had no idea the price would go up this high,” said Albert Fox Cahn, the advocacy group’s executive director. “Even as New Yorkers find themselves on the hook for millions more, the app still isn’t able to do a lot of the basics.”

The governor’s office defended the contract, noting that it would only spend the full amount if the program continued to be successful. It said that so far the state had only spent $4.7 million, a fraction of the total amount.

“The state amended the upper limit of the contract so we have the option — only to be undertaken if the pass continues to be a success — to further expand the pass’s critical role in supporting New York State’s economic recovery, including the potential to connect with neighboring states whose residents travel in and out of New York routinely as they live, work, and play,” said Jason Gough, a spokesman for Gov. Andrew M. Cuomo.

The contract lists some of the issues that software engineers were called in to fix, such as incorrect error messages and crashes. Engineers added foreign language capability, access for the visually impaired and, to address a common problem, made it so the phone number entered by a user does not need to match what is listed in the vaccine registries. The fixes are ongoing. Not until June, the contract indicates, did the app make it possible for someone who has periods in their name (like T.J.) to retrieve a pass.

Some users are still having trouble finding their passes, sometimes because the registries have outdated information listed, like an old ZIP code. In order to find a person’s vaccination record, the app checks his or her name, date of birth, ZIP code and county of vaccination against the vaccine registry, and nearly all information must match. Some 4 percent of users who tried to get passes in the app’s opening months were unable to, the state said.

Phase 2 of the contract included the development of what the state has called Excelsior Pass Plus, which launched on Aug. 4. The main enhancement of the Plus pass is that it now includes the date, place and type of vaccination in the QR code, instead of just verifying that a person is vaccinated. That information will be shared when the app is scanned, but it allows for a wider range of places to use it as vaccination proof.

American Airlines is accepting the pass for travel to some international destinations. Both the original and the Plus pass also allow users to show results of P.C.R. and antigen tests, the state said. About 400,000 Plus passes have been issued to date, the state said.

For now, both types of Excelsior passes are only available for people vaccinated in New York, and New York residents vaccinated out of state who ask their health care providers to upload that information to the New York vaccine registries.

But the contract lays out a new, previously undisclosed Phase 3, which is projected to cost $6.7 million. By this summer, the contract states, the app was expected to add the ability to track third doses. It was also to begin including data from New Jersey and Vermont, presumably to allow more people vaccinated in those states to get passes.

Mr. Gough, the governor’s spokesman, said that the extension to other states had not happened yet, so that money had not been spent. He also noted that the money so far spent on the program was expected to be reimbursed by the federal government.