apple: verify signed payload

This block is part of the payments group and was last modified in core v15.0.0.

apple: verify signed payload condition v15.0.0

Verifies an Apple-signed JWS : an App Store Server Notification's signedPayload, or the signedTransactionInfo / signedRenewalInfo nested inside one : and returns its claims. The signature is the only thing separating a real purchase from someone posting themselves a subscription, so nothing downstream should trust a payload this block did not pass.

In pins 3 + flow

flow
flow
signed payload required
value
The JWS to verify: a notification's signedPayload, or a nested signedTransactionInfo / signedRenewalInfo.
root certificate required
value
Apple's root CA in PEM, the trust anchor for the chain. Download AppleRootCA-G3 from https://www.apple.com/certificateauthority/ and keep it in a system setting. Without it this block refuses : it is not baked in so a rotated root needs a setting change, not a release.
bundle id
value
Your app's bundle id. Strongly recommended: a valid signature only proves Apple signed it, not that it was about your app : without this, another developer's notification verifies perfectly.

Out pins 14 + flow

flow
flow
success
condition
True only when the chain verified to the supplied root, the signature checked out, and the bundle id matched.
error
value
MISSING_SIGNED_PAYLOAD, MISSING_ROOT_CERTIFICATE, MALFORMED_JWS, INVALID_CERTIFICATE_CHAIN, UNSUPPORTED_ALGORITHM, CERTIFICATE_CHAIN_NOT_TRUSTED, UNSUPPORTED_LEAF_KEY, SIGNATURE_INVALID or BUNDLE_ID_MISMATCH.
payload
object
The verified claims.
notification type
value
SUBSCRIBED, DID_RENEW, EXPIRED, REFUND, … (notifications only).
subtype
value
INITIAL_BUY, RESUBSCRIBE, VOLUNTARY, BILLING_RETRY, … (notifications only).
bundle id
value
environment
value
Production or Sandbox. Worth branching on : a sandbox purchase must never grant a real entitlement.
signed transaction info
value
Still signed, and deliberately not decoded here: run it back through this block. Handing back an unverified inner payload is the mistake this block exists to prevent.
signed renewal info
value
As above : verify it separately.
original transaction id
value
The stable id for a subscription across every renewal : the one to store against a user.
product id
value
transaction id
value
expires date
number
Expiry in unix milliseconds, 0 when absent.
revocation date
number
Set when Apple refunded or revoked the purchase : non-zero means revoke the entitlement.

apple

app store

iap

in app purchase

subscription

notification

verify

jws

storekit

receipt

Apple posts subscription events to a URL you register, signed rather than authenticated, so the signature is the only thing that makes the message trustworthy. verify signed payload takes the raw body from get raw body and checks it against the Apple root certificate. Only the true side of the branch may change anything: the notification_type pin tells you what happened, and original_transaction_id is the id that stays stable across renewals, which is the one to store against the account.

Version history

Introduced in v15.0.0.

Service documentation

External API reference This block wraps a third-party service. Click here for the service's own documentation of the underlying endpoint.

Back to payments Return to the main group to view all sub-groups Back to appstore Return to the group to view all blocks within this group