Apple receipt validation confirms that an in-app purchase or subscription is genuine before your app unlocks paid content. It answers one question: Did this user really pay Apple for this?
An App Store receipt was Apple’s original proof of purchase, a signed PKCS#7 file on the device that listed every transaction for the app. Apple deprecated that model. Apple deprecated receipts, and it deprecated the verifyReceipt endpoint that servers are used to check on June 5, 2023.
Today, you validate purchases through StoreKit 2 and the App Store Server API. StoreKit 2 hands your app a signed JWS (JSON Web Signature) transaction in place of the old base64 receipt blob. You confirm that the transaction in one of two ways:
- Verify it locally. Decode and verify the signed JWS with Apple’s App Store Server Library, which ships in Swift, Java, Node.js, and Python. No call to Apple’s servers required.
- Verify it server-side. Send the transaction ID to your server, authenticate with a signed JWT, and query the App Store Server API for Apple-signed transaction and subscription data.
The App Store Server Notifications V2 endpoint pushes the same signed data to your server for lifecycle events like renewals, refunds, and cancellations.
For the step-by-step server-side setup, follow Adapty’s implementation guide: Validating IAP with the App Store Server API.
Legacy model
The original flow parsed a PKCS#7 receipt on the device or sent it to the verifyReceipt endpoint with a shared secret. Apple deprecated both. verifyReceipt still works and has no announced end-of-life date, but it receives no new features, and Apple recommends moving to the App Store Server API and Notifications V2 now.
How Adapty handles receipt validation
Adapty is a subscription infrastructure platform that runs Apple receipt validation for you, server-side, so you never parse a JWS or wire up the App Store Server API yourself. The Adapty SDK sends each StoreKit 2 transaction to Adapty, Adapty verifies it with Apple, and stores the result, and your app reads one trusted subscription status.
- Server-side validation. Adapty verifies every transaction with Apple’s App Store Server API, not on the device, so a tampered or replayed receipt cannot unlock paid features.
- Real-time subscription status. App Store Server Notifications V2 keeps each user’s access state current through renewals, refunds, grace periods, and cancellations, with no polling on your side.
- Cross-platform sync. One subscription status follows the user across iOS, Android, and web, so a purchase on one platform grants access on the rest.
Start with the Adapty SDK and the documentation, and use Subscription Sync to keep entitlements aligned across devices. To spot-check a single receipt by hand, use the Apple receipt checker.