How to do iOS Receipt Validation in Objective-C

Until you do it yourself, receipt validation might feel like one of the most unclear topic, when it comes to verifying In App Purchases (IAP) on iOS platform for an App Developer.

This post documents the exact steps and code needed to perform receipt validation with AppStore.

The Receipt

As soon as the app is installed or updated, Apple puts a purchase receipt (signed by Apple via AppStore) in the main bundle of the app.

Think of the receipt as the trusted record of a purchase. It also includes any in-app purchases that the user might have made.

Receipt Validation

By verifying the receipts, App Developers can protect their revenue and enforce their business model directly in their application. Receipt Validation plays a key role in verifying whether the auto-renewing subscription is currently active or not.

Here are the steps needed to validate the receipt.

• First step in the process is to load the receipt from apps main bundle

• If the receipt is not found, we could refresh the receipt using SKReceiptRefreshRequest
• This is especially helpful during development and debugging.
• Refreshing the receipt tells the system that the application needs to retrieve a new receipt

• Before we could send the receipt information to AppStore, we will need the App's Shared Secret.
• To get this, log on to itunesconnect and navigate to My Apps -> Click on your App -> Click on Features 
• Click on the In-App Purchases section. On the right side you will see the link App-Specific Shared Secret, click this link to generate the App-Specific Shared Secret. It will pop up a dialog where you could generate a new secret or view the existing secret.
• Note down the generate secret somewhere, we need to pass this value to AppStore for receipt verification.

• Next, we need send the receipt details along with App-Specific Shared Secret to AppStore. We have to hit different URL based on whether the app is running in the sandbox environment or production environment.

• Now we need to send the Base 64 encoded receipt information along with App-Specific shared secret to the AppStore API. The response of this API is a JSON object with details about various purchases user has made on the app.

• Full list of receipt fields found in this JSON response can be found here
• "latest_receipt_info" field is part of the JSON response. It is an Array containing the details of IAP and Subscription purchases made by the user on the app. 
• Each purchase holds information like
• Which product was purchased: "product_id"
• When was the purchase made: "original_purchase_date"
• Whether or not the auto-renewing subscription is running the trial period: "is_trial_period"
• The date of the auto-renewing subscription expires: "expires_date"
• What was the intent behind the subscription expiration: "expiration_intent"
• Now all that is left is to parse the JSON response and iterate through the contents of "latest_receipt_info" field. Here's the code that does it.

Thats about all that is needed to perform receipt validation.

However, please note that, since we can't build a trusted connection between a user’s device and the App Store directly, we should should always call AppStore receipt validation API from a trusted server. Details of how to do that, is out of scope of this post.