All packsApp Store MachinerySolve
storekit 2 appaccounttoken missing join user
Without appAccountToken, nothing reliably joins a transaction to a user
Apple's transaction and notification streams have no user id field of their own -- appAccountToken is the only stable join key, and it has to be set at purchase time.
This is one of the things App Store Machinery already handles. Sell subscriptions and one-time unlocks in your iOS app, and get it through App Review.
Is this you?
A StoreKit 2 transaction or App Store Server Notification carries a product id, an original transaction id, and various dates -- but nothing that identifies which of the app's own users made the purchase, unless the app explicitly attached one. A server trying to grant entitlements based on a bare product id, with no reliable link back to a specific account, either has to guess (risky) or can't correctly attribute purchases across devices and reinstalls at all.
Why this one is easy to get wrong
Product.purchase() works and returns a valid transaction without appAccountToken ever being set -- the purchase flow itself gives no error or warning that anything is missing, because from StoreKit's perspective the purchase is complete and correct. The gap only becomes visible later, server-side, when there's a transaction to process and nothing in it says whose account it belongs to.
What you get instead
Decision 4 makes appAccountToken mandatory on every Product.purchase() call: a stable UUID per user account, stored server-side, passed via .appAccountToken(userUUID) at purchase time. It comes back inside every signed transaction and every notification from then on, which the architecture states plainly is "the only reliable join between Apple's transaction stream and your user table" -- set once, at the one moment it can be attached, or it's unrecoverable later.
Source: ARCHITECTURE.md decision 4 — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 21 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
3 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →