Receipt validation
Trust every receipt, not the client.
Every Apple and Google purchase is verified on your servers — signature-checked, replay-proofed, fraud-scored — before it ever becomes an entitlement.
- Apple + Google
- Replay & refund proof
- Grace-period aware
Receipt validation Apple Google
transactiontxn 1000000…
productpro_monthly
purchase date2026-07-18
Store signature
Replay & fraud
Entitlement
verifying against store keys…
App Store Server API
Google Play Developer API
S2S notifications, ingested
Idempotent, auditable records
How it works
From receipt to entitlement, verified
1
Receive
A purchase or server notification arrives from the App Store or Google Play.
2
Verify signature
The receipt is cryptographically checked against store keys before anything else runs.
3
Check replay & fraud
Reused, tampered, and anomalous receipts are caught and scored for abuse.
Grant entitlement
Only a clean, verified purchase becomes an entitlement your app can rely on.
Receipt validation Apple Google
transactiontxn 1000000…
productpro_monthly
purchase date2026-07-18
Store signature
Replay & fraud
Entitlement
verifying against store keys…
No client trust
A green check, or a red X — never a client boolean.
Your app never decides what's paid. CashSDK reads the real receipt, proves it against the store, and only then flips the entitlement. Forged, replayed, or refunded receipts get rejected with a reason you can see.
Defense in depth
Every way a purchase can lie, checked
CashSDK validates end to end and becomes your single source of truth.
Signature verification
Verify App Store and Play receipts against store keys, server-side.
Replay & tamper protection
Reused and altered receipts are caught before they grant access.
Refund & chargeback handling
Refunds, chargebacks, and revocations flow back and revoke the entitlement automatically.
Source of truth
One canonical, idempotent purchase record, reconciled with the stores.
Reconciled
What your app grants is what the store actually charged
0%
Receipts verified server-side
0
Client booleans trusted
< 0ms
Median validation time
On your infrastructure
Refunds, renewals, and grace periods — handled where they happen
Apple and Google server-to-server notifications land, get verified, and update the entitlement: a renewal extends it, a refund revokes it, a billing retry drops it into grace instead of cutting access.
- Apple & Google S2S notifications, verified on arrival
- Grace periods keep good customers in during billing retries
- Refunds & chargebacks revoke access, idempotently and auditably
Risk score
Per purchase, in real time
0.04
low risk
Device velocityclear
Sandbox abuseclear
Receipt reuseclear
Refund farmingflagged
Subscription lifecycle auto-modeled
Trial
7 days
Active
$8.99/mo
Grace
billing retry
Expired
win-back
entitlementpro · active
iOS
synced
Android
synced
Web
synced
Verify every purchase before you unlock it
Put server-side validation in front of every entitlement and stop trusting purchases you can't prove.