All packsApp Store MachinerySolve
app store verifyreceipt deprecated still used
verifyReceipt is deprecated, and it's still the path of least resistance
The legacy verifyReceipt endpoint is deprecated, but it's still what an agent unfamiliar with StoreKit 2 reaches for first -- the pack bans it and greps for it in preflight.
What goes wrong
Apple's legacy verifyReceipt HTTP endpoint is deprecated in favor of local JWS verification via StoreKit 2's SignedDataVerifier -- but it's still documented in older tutorials, still technically callable, and still the shape of solution most in-app-purchase guides describe, because most of them predate StoreKit 2. Code built against it works today and is built on an endpoint Apple can retire, with no local cryptographic verification of transactions at all.
Why agents get it wrong
verifyReceipt is the historically dominant pattern for validating App Store purchases, and a large share of indexed tutorials, Stack Overflow answers, and sample code still describe it -- an agent without a specific instruction to use StoreKit 2's local verification instead has every reason, based on training data prevalence, to reach for the deprecated but familiar path.
What App Store Machinery pre-decides
Decision 1 states the rule as a hard ban, not a preference: all validation is local JWS verification via SignedDataVerifier with Apple's root certificates, and the review-rejection preflight explicitly greps the repo for the literal strings verifyReceipt and appStoreReceiptURL -- if either appears anywhere, the preflight fails the build before it ships, rather than relying on a reviewer noticing the wrong approach was used.
Source: ARCHITECTURE.md decision 1