Server-side receipt validation

Definition

Server-side receipt validation is the practice of sending a purchase token (or signed transaction) to a trusted backend server, which then calls the Google Play Developer API (or Apple App Store Server API) to confirm authenticity and retrieve the purchase state. The alternative — client-side validation — runs the same check on the user's device, which means a modified or compromised app can fake the verification result.

This is a fundamental security boundary in subscription apps. Client-side checks are advisory at best; server-side validation is the only way to ensure a user genuinely holds a valid, non-revoked purchase. It also keeps your API keys off the client, eliminating a key extraction vector.

Examples

• An Android app sends a purchase token to the developer's Node.js backend. The backend calls Tierux's verify endpoint, which queries the Android Publisher API, confirms the purchase, and returns an entitlement record.
• A jailbroken iOS device attempts to claim a "verified" purchase by intercepting and modifying the client-side validation response. Since the actual check runs on the server, this attack fails — the server independently queries Apple.
• Tierux provides one REST endpoint for both Google Play and Apple verification, normalizing the result into a consistent entitlement shape regardless of platform.