A practical guide to server-side receipt validation

If your app decides whether someone is premium based on a boolean the client sends up, you have a problem. Receipts must be verified on a server you control.

Verify the signature

Both Apple and Google sign their receipts. The first job of a validation pipeline is to confirm that signature cryptographically before trusting a single field inside.

Guard against replay

A valid receipt can be captured and replayed. Track transaction identifiers and reject anything you've already processed, so a single purchase can't unlock many accounts.

Reconcile with server notifications

Purchases change after the sale - renewals, refunds, grace periods. Ingesting App Store and Play server notifications keeps your entitlement state correct over time, not just at the moment of purchase.

CashSDK does all of this for you and exposes one answer: is this entitlement active? Everything else is an implementation detail you no longer have to own.

1// one answer, server-verified — no receipts to parse yourself
2const { active } = await cashsdk.entitlements.check({
3  userId,
4  entitlement: "premium",
5});
6 
7if (!active) return paywall();