app store server api jws verification x5c chain

Trusting a transaction means verifying its whole certificate chain

A transaction's JWS carries an x5c certificate chain that has to verify all the way to an Apple root cert -- trusting the payload without walking that chain trusts nothing.

This is one of the things App Store Machinery already handles. Sell subscriptions and one-time unlocks in your iOS app, and get it through App Review.

Buy for $1293 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

StoreKit 2 transactions and Server Notifications arrive as signed JWS payloads whose x5c header carries a certificate chain, and the server has to walk that chain up to a genuine Apple root certificate to actually trust the payload's contents. Code that decodes the JWS (reading its claims as plain JSON, which is trivial since JWS payloads are just base64) without verifying the signature and chain accepts anything shaped like a valid transaction, including one an attacker constructed themselves.

Why this one is easy to get wrong

A JWS is easy to partially decode without a library at all -- split on dots, base64-decode the middle segment, read the JSON -- and that shortcut produces data that looks completely legitimate for every transaction that actually came from Apple, since real payloads decode to sensible-looking claims. Nothing about that shortcut fails until someone deliberately sends a forged payload, which a functional test suite built around real Apple transactions never does.

What you get instead

The server is architected as the entitlement authority specifically because client-reported state can't be trusted (decision 2): every transaction is verified server-side via @apple/app-store-server-library's SignedDataVerifier, configured with Apple's actual root certificates fetched once from apple.com and committed to the repo. The pack's own test strategy (decision 13) generates a real 3-certificate ECDSA chain with Apple's marker OIDs and runs the genuine verifier against it offline, including negative tests -- tampered payload, wrong bundle id, wrong environment -- that must all reject.

Source: ARCHITECTURE.md decisions 2, 3, 5 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 21 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $129 14-day refund if verify.sh fails →