Receipts

Validate Apple and Google receipts server-side and unlock entitlements.

Receipt validation is the core of CashSDK. Submit a raw store receipt and CashSDK verifies it against Apple or Google, records the resulting transaction, updates the customer's entitlements, and returns the entitlements the receipt unlocked, all in one call.

Always validate receipts on your server (or let the SDK route them through CashSDK). Never trust a client-side "purchase succeeded" signal to unlock paid features.

Validate a receipt#

POST /v1/receipts/validate

Verifies a receipt and syncs the resulting entitlements to the customer. The call is idempotent: submitting the same receipt again returns the current state without creating duplicate transactions.

platformstringrequired

The store the receipt came from: apple or google.

receiptstringrequired

The raw receipt data. For Apple, the base64-encoded App Store receipt or a StoreKit 2 signed transaction. For Google, the purchase token.

app_user_idstringrequired

The customer to attribute the purchase to, e.g. u_812.

bash

curl -X POST https://api.cashsdk.com/v1/receipts/validate \
  -H "Authorization: Bearer csk_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "platform": "apple",
    "receipt": "MIIT...base64...",
    "app_user_id": "u_812"
  }'

json

{
  "valid": true,
  "app_user_id": "u_812",
  "entitlements": {
    "pro": {
      "is_active": true,
      "product_id": "pro_monthly",
      "expires_at": "2026-08-17T18:24:05Z",
      "store": "app_store"
    }
  },
  "transaction": {
    "id": "txn_9f2a1c",
    "product_id": "pro_monthly",
    "amount": 899,
    "currency": "USD",
    "type": "purchase",
    "store": "app_store",
    "created_at": "2026-07-17T18:24:05Z"
  }
}

Response fields#

validboolean

Whether the receipt verified successfully against the store.

app_user_idstring

The customer the entitlements were synced to.

entitlementsobject

A map of entitlement ID to its resulting state.

Show entitlement

is_activeboolean

Whether the entitlement currently grants access.

product_idstring

The product that granted the entitlement.

expires_atstring

ISO 8601 expiry, or null for lifetime access.

storestring

The source store, e.g. app_store or play_store.

transactionobject

The transaction recorded from this receipt, or null if the receipt verified but produced no new transaction.

Invalid receipts#

A receipt that fails verification returns 422 Unprocessable with an error body, not a 200 with "valid": false:

json

{
  "error": {
    "code": "unprocessable",
    "message": "The receipt could not be verified with the App Store."
  }
}

See Errors for the full list of codes.

Next steps#

Receipt validation guide

End-to-end setup with the SDKs.

Webhooks

Get notified of renewals and refunds after the sale.