Verifying in-app purchases on the server

Backends for mobile apps Mid-level Python 3.13+ PostgreSQL 17+ Reviewed 31 Oct 2026 By Best Latest Apps

Order the steps

Order granting a subscription.

Server verifies it with the store's server API
Store notifications update renewals and refunds
App completes the purchase and sends the transaction to your server
App fetches entitlements and unlocks features
Server records the entitlement, keyed by original transaction id

Choose an answer, then open Show answer below to check it.

Show answer

Answer: C A E D B

App completes the purchase and sends the transaction to your server Not yet trusted.
Server verifies it with the store's server API Signed and genuine.
Server records the entitlement, keyed by original transaction id Idempotent.
App fetches entitlements and unlocks features Server is the source of truth.
Store notifications update renewals and refunds Keeps access correct.

30-second answer

Never trust the app saying 'purchase succeeded'. Send the transaction to your server, verify it with the store's server API (Apple's App Store Server API with signed transactions, Google Play Developer API), then grant entitlements in your database keyed to the user. Subscribe to the stores' server notifications (App Store Server Notifications, Google Real-time Developer Notifications) for renewals, refunds and cancellations, and make processing idempotent by transaction id.

Practise saying it · 30 s. No recording, just a timer

Verify purchases.

Say your answer out loud, then check which of these points you covered:

Never trust the client
Verify with store APIs
Entitlements in DB
Server notifications
Idempotent by transaction id

Deep dive

Apple's signed transactions are JWS; verify the certificate chain.

Acknowledge Google purchases within three days or they're refunded.

Store original transaction ids to link renewals to one subscription.

Reconcile periodically in case notifications are missed.

Common mistakes

Granting access from a client-side flag.
Ignoring refund notifications.
Processing the same notification twice.

Senior take & follow-ups

Server verification, entitlements in your DB, store notifications, idempotency, reconciliation.

Follow-up questions

Think of your answer first, then open the hint.

What happens if Google purchases aren't acknowledged?
Show hint
They're automatically refunded after three days.
How do you handle refunds?
Show hint
Revoke the entitlement when the notification arrives.

Suggest a fix if something here is wrong or out of date.