app store verifyreceipt deprecated still used

verifyReceipt is deprecated, and it's still the path of least resistance

The legacy verifyReceipt endpoint is deprecated, but it's still what an agent unfamiliar with StoreKit 2 reaches for first -- the pack bans it and greps for it in preflight.

This is one of the things App Store Machinery already handles. Sell subscriptions and one-time unlocks in your iOS app, and get it through App Review.

Buy for $1293 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Apple's legacy verifyReceipt HTTP endpoint is deprecated in favor of local JWS verification via StoreKit 2's SignedDataVerifier -- but it's still documented in older tutorials, still technically callable, and still the shape of solution most in-app-purchase guides describe, because most of them predate StoreKit 2. Code built against it works today and is built on an endpoint Apple can retire, with no local cryptographic verification of transactions at all.

Why this one is easy to get wrong

verifyReceipt is the historically dominant pattern for validating App Store purchases, and a large share of indexed tutorials, Stack Overflow answers, and sample code still describe it -- an agent without a specific instruction to use StoreKit 2's local verification instead has every reason, based on training data prevalence, to reach for the deprecated but familiar path.

What you get instead

Decision 1 states the rule as a hard ban, not a preference: all validation is local JWS verification via SignedDataVerifier with Apple's root certificates, and the review-rejection preflight explicitly greps the repo for the literal strings verifyReceipt and appStoreReceiptURL -- if either appears anywhere, the preflight fails the build before it ships, rather than relying on a reviewer noticing the wrong approach was used.

Source: ARCHITECTURE.md decision 1 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 21 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $129 14-day refund if verify.sh fails →