StoreKit Verification

StoreKit 2 and JWTs

Apple's StoreKit 2 returns a signed JWS (JSON Web Signature) for each transaction. This JWS contains the full transaction payload and is signed by Apple. Tierux verifies this signature server-side — your backend never trusts an unverified client claim.

Send the JWS to Tierux

After your iOS app captures a StoreKit 2 transaction, send the JWS representation and transaction ID to your backend, which forwards them to Tierux for server-side verification.

// Your backend calls Tierux
curl -X POST https://tierux.com/api/v1/purchases/apple/verify \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "appId": "app_123",
    "userId": "user_abc",
    "transactionId": "2000000012345678",
    "jwsRepresentation": "eyJhbGciOiJFUzI1NiIs..."
  }'

Server-side verification process

Tierux performs the full verification chain server-side:

1. Parse the JWS header — extract the signing algorithm and key ID (x5c certificate chain)
2. Validate certificates — verify the signing certificate chains to Apple's root CA
3. Verify the signature — validate the JWS signature against the certificate's public key
4. Decode the payload — extract the transaction data (product ID, expiry, revocation status)
5. Normalize — map to Tierux's standard entitlement state

// 200 OK response
{
  "ok": true,
  "userId": "user_abc",
  "entitlement": "pro",
  "active": true,
  "expiresAt": "2026-08-01T00:00:00.000Z",
  "status": "active",
  "platform": "apple"
}

App Store Server Notifications

Tierux also handles Apple's App Store Server Notifications v2 (JWS-signed) to keep entitlement state current — renewal, expiry, billing retry, refund notifications are processed automatically.

Apple verification and store setup

Tierux doesn't need your App Store Connect credentials for signed-JWS verification. For production Apple verification, provide both the Bundle ID and App Apple ID during Tierux project setup. App Store Connect product and notification setup remains manual; Tierux then validates StoreKit 2 JWS transactions against Apple's public certificates and processes signed lifecycle notifications.