Receipts

Validate Apple and Google receipts server-side and unlock entitlements.

Receipt validation is the core of CashSDK. Submit a raw store receipt and CashSDK verifies it against Apple or Google, records the resulting transaction, updates the customer's entitlements, and returns the entitlements the receipt unlocked — all in one call.

Always validate receipts on your server (or let the SDK route them through CashSDK). Never trust a client-side "purchase succeeded" signal to unlock paid features.

Validate a receipt#

POST /v1/receipts/validate

Verifies a receipt and syncs the resulting entitlements to the customer. The call is idempotent: submitting the same receipt again returns the current state without creating duplicate transactions.

platformstringrequired

The store the receipt came from: apple or google.

receiptstringrequired

The raw receipt data. For Apple, the base64-encoded App Store receipt or a StoreKit 2 signed transaction. For Google, the purchase token.

app_user_idstringrequired

The customer to attribute the purchase to, e.g. u_812.

bash

curl -X POST https://api.cashsdk.com/v1/receipts/validate \
  -H "Authorization: Bearer csk_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "platform": "apple",
    "receipt": "MIIT...base64...",
    "app_user_id": "u_812"
  }'

json

{
  "valid": true,
  "app_user_id": "u_812",
  "entitlements": {
    "pro": {
      "is_active": true,
      "product_id": "pro_monthly",
      "expires_at": "2026-08-17T18:24:05Z",
      "store": "app_store"
    }
  },
  "transaction": {
    "id": "txn_9f2a1c",
    "product_id": "pro_monthly",
    "amount": 899,
    "currency": "USD",
    "type": "purchase",
    "store": "app_store",
    "created_at": "2026-07-17T18:24:05Z"
  }
}

Response fields#

validboolean

Whether the receipt verified successfully against the store.

app_user_idstring

The customer the entitlements were synced to.

entitlementsobject

A map of entitlement ID to its resulting state.

Show entitlement

is_activeboolean

Whether the entitlement currently grants access.

product_idstring

The product that granted the entitlement.

expires_atstring

ISO 8601 expiry, or null for lifetime access.

storestring

The source store, e.g. app_store or play_store.

transactionobject

The transaction recorded from this receipt, or null if the receipt verified but produced no new transaction.

Invalid receipts#

A receipt that fails verification returns 422 Unprocessable with an error body, not a 200 with "valid": false:

json

{
  "error": {
    "code": "unprocessable",
    "message": "The receipt could not be verified with the App Store."
  }
}

See Errors for the full list of codes.

Next steps#

Receipt validation guide

End-to-end setup with the SDKs.

Webhooks

Get notified of renewals and refunds after the sale.