Glossary · Store notifications
What is a JWS signed transaction?
JWS signed transaction
A JWS signed transaction is transaction data that the App Store signs in JSON Web Signature format. It is one string of three Base64URL parts separated by periods: a header, a payload and a signature. Your server decodes the payload to read the purchase, and verifies the signature against Apple's certificates to prove that Apple issued it.
StoreKit 2 returns each transaction, each renewal info and each app transaction as a signed value, and StoreKit verifies them for you on the device. You can also send the raw JWS string to your server and verify it there for the most control. Apple recommends the App Store Server Library, whose functions verifyAndDecodeTransaction, verifyAndDecodeRenewalInfo and verifyAndDecodeAppTransaction check the signature and decode the payload. The header holds the certificate chain that you use to verify.
The decoded payload has fields such as transactionId, originalTransactionId, productId, bundleId, purchaseDate, expiresDate, environment, ownershipType and the offer details. App Store Server Notifications V2 and the App Store Server API also return signed transactions in this format.
RevenueDot verifies a StoreKit 2 signed transaction against Apple's root certificate, checks that the bundle ID matches the app, and uses the original transaction ID as the subscription key. With the In-App Purchase key it then asks Apple for the full history. A signature that does not verify gets a 4xx answer, so the SDK drops the bad purchase.
Sources: Apple: JWSTransaction · Apple: VerificationResult · Apple: Apple In-App Purchase (StoreKit) · Apple: App Store Server API
FAQ
JWS signed transaction: questions people ask
What does JWS stand for?
JSON Web Signature. It is a standard way to sign JSON so that anyone with the right certificate can check the data was not changed.
Do I still need server validation if StoreKit verifies on the device?
StoreKit's check is enough to give access on the device. Verify on your server when you share entitlements across devices or platforms, when you issue server-side rewards, or when you need the data for your records.
What is the difference between JWSTransaction and JWSRenewalInfo?
A JWSTransaction describes one purchase or renewal. A JWSRenewalInfo describes what happens at the next renewal, such as the auto-renew status or eligible win-back offers.
Get started
Run subscriptions without the revenue share.
Start free on RevenueDot Cloud, free up to $10,000 a month in tracked revenue, or move an existing RevenueCat app with one line of code.
Already have an account? Sign in · Prefer your own servers? Self-host free