GitHub Start free

Feature

Trusted Entitlements: signed responses for the RevenueCat SDK on your own server

RevenueDot signs every SDK response with an Ed25519 signature in the format the RevenueCat SDKs verify, once you set REVENUEDOT_SIGNING_KEY. The stock SDK trusts only RevenueCat's key, so against RevenueDot it reports verification FAILED. Turn verification off in the stock SDK, or use a RevenueDot fork that trusts your key.

Start free on Cloud Read the guide →

Free up to $10,000 a month in tracked revenue. Works with the RevenueCat SDK you already ship.

Signed responses

Every 2xx and 3xx response under /v1 and /rcbilling carries an X-Signature header.

Intermediate keys

The server makes a new intermediate key every 30 days. Only the root seed is configured.

Verified in tests

The server's contract tests check the format against real signatures and reject tampered bodies, nonces and paths.

Cloud is signed

RevenueDot Cloud signs with a public key published at /.well-known/revenuedot-signing-key.

What does each SDK setup give you?

Defaults differ per SDK. iOS and Android are informational, React Native, Flutter and Kotlin Multiplatform default to disabled, and purchases-js does not verify.

App usesServerResult
Stock RevenueCat SDK, verification DISABLEDAnyNo check. Everything works. Recommended for proxy mode.
Stock SDK, INFORMATIONAL (the iOS and Android default)AnyEntitlements work, but each carries verification FAILED and the SDK logs an error.
Stock SDK, ENFORCEDAnyEvery request fails. Never use it against RevenueDot.
RevenueDot fork, official buildRevenueDot CloudVERIFIED
RevenueDot fork built with your public keyYour server with REVENUEDOT_SIGNING_KEYVERIFIED

Steps

How to turn on response signing

  1. 01

    Generate a key pair

    In a checkout of the server repository run pnpm tsx scripts/signing-keygen.ts. It prints the REVENUEDOT_SIGNING_KEY seed and the public key.

  2. 02

    Give the seed to the server

    Set REVENUEDOT_SIGNING_KEY as an environment variable and keep it in your password manager. Anyone with the seed can sign responses your apps trust.

  3. 03

    Restart and check the public key

    Call /.well-known/revenuedot-signing-key. Without a key it answers 404 and responses are not signed.

  4. 04

    Choose the app side

    Turn verification off in the stock SDK, or build the SDK forks with your public key to get VERIFIED.

How do you check the signing key?

Check the public keycurl
curl -s http://localhost:8787/.well-known/revenuedot-signing-key

# {"algorithm":"Ed25519","public_key":"ZzwPxGlon0E8ErpDh9QAH0Jh6+E6D6qufvTSetXZY9Y=","encoding":"base64","header":"X-Signature","docs":"https://revenuedot.app/docs"}

What does the signature cover?

The X-Signature value is base64 of 180 bytes: an intermediate Ed25519 public key, its expiry in days, the root key's signature over both, a random salt, and the intermediate key's signature over the message. The message is the salt, the API key, the nonce, the request path, the request hash headers, the response time and ETag headers, and the body. The SDK sends a random X-Nonce with requests it verifies, and the nonce is part of the message.

RevenueDot Cloud signs with the public key gXdn2hmqR/TbdtQwK02laE0YgFz0Rtf918LICLrgZhg=. A self-hosted server signs with its own key, so the official forks verify only against RevenueDot Cloud. Rotating the root key means shipping new SDK builds, because the key is compiled into the app.

FAQ

Trusted Entitlements: questions people ask

Why does the RevenueCat SDK report signature verification FAILED with RevenueDot?

The stock SDK checks responses against RevenueCat's public key, and RevenueDot cannot sign with RevenueCat's private key. Set verification to disabled in the SDK, or use a RevenueDot fork that trusts RevenueDot's key. Access still works in informational mode, but the SDK logs errors.

Should I use ENFORCED entitlement verification with RevenueDot?

Not with the stock SDK. Every request would fail, because the stock SDK trusts only RevenueCat's key. Use DISABLED in proxy mode, or a RevenueDot fork, which verifies RevenueDot's signatures.

How do I get VERIFIED entitlements on my own server?

Generate a signing key pair, set REVENUEDOT_SIGNING_KEY on the server, and build the RevenueDot SDK forks with your public key and host using the fork pipeline. The official forks trust only RevenueDot Cloud's key.

Does RevenueDot Cloud sign its responses?

Yes. RevenueDot Cloud signs every SDK response, and its public key is served at /.well-known/revenuedot-signing-key. The official RevenueDot forks trust that key and report VERIFIED.

Get started

Run subscriptions without the revenue share.

Start free on RevenueDot Cloud, free up to $10,000 a month in tracked revenue, or move an existing RevenueCat app with one line of code.

Start free on Cloud Migrate from RevenueCat →

Already have an account? Sign in · Prefer your own servers? Self-host free