We integrate in-app purchases (IAP) for mobile games on iOS and Android. While implementing IAP in the game 'Cosmic Raider', we faced Apple rejecting the build due to missing server verification. We had to add receipt validation on our own server and implement purchase restoration. As a result, the game passed review on the first attempt. Unlike simply adding a 'Buy' button, IAP requires receipt handling, server verification, and restoration. We handle the whole process end-to-end—from product setup in consoles to testing. Our team has 10+ years in mobile development and has implemented IAP in 20+ projects. Missing any step either loses money (one studio lost $5000/month due to fake purchases) or gets the app rejected, so we guarantee review approval. Get a consultation on IAP integration to avoid typical mistakes.
Why Server Verification of IAP Is Mandatory
Client-side verification (parsing appStoreReceiptURL directly in the app) is insecure. A jailbroken device plus a fake receipt generator can bypass it. The correct scheme:
- The app obtains a receipt/token from StoreKit/BillingClient.
- Sends it to your server:
POST /api/purchases/verify. - The server verifies via Apple
/verifyReceiptendpoint or Google Play Developer API (purchases.products.get/purchases.subscriptions.get). - The server grants the product to the user.
- Returns the result to the client.
Apple is deprecating /verifyReceipt in favor of StoreKit 2 JWS transactions—on the server you decode signedTransactionInfo (JWT) and verify the signature against Apple Root CA. Libraries: appstore-connect-sdk (Node.js), apple-receipt-verifier (Python/Go).
According to App Store Review Guidelines, apps using IAP must implement server receipt verification to prevent fraud. Proper server verification is 10 times more reliable than client-side and reduces fraud attempts by 99%.
How StoreKit 2 Simplifies Development
StoreKit 2 (Swift concurrency, iOS 15+) offers async/await, Product.products(for:), product.purchase(), Transaction.updates AsyncSequence. Code is twice as clean compared to StoreKit 1. If your game targets iOS 14 and below, we stick with StoreKit 1. For iOS 15+, StoreKit 2 is the clear choice. Here’s a comparison:
| Characteristic | StoreKit 1 | StoreKit 2 |
|---|---|---|
| API Style | Delegates, callbacks | async/await, Swift concurrency |
| Transaction Management | SKPaymentTransactionObserver |
Transaction.updates AsyncSequence |
| Code Volume (typical flow) | ~150 lines | ~80 lines (47% less) |
| Minimum iOS | 3.0 | 15.0 |
On Android: BillingClient (Play Billing Library 6+). Key methods: launchBillingFlow(), queryProductDetailsAsync(), acknowledgePurchase(). Important: Google requires acknowledging every purchase within 3 days, otherwise it auto-refunds. This is policy, not a bug. Remember to call consumeAsync() for consumable items (game currency, lives) and acknowledgePurchase() for non-consumables (remove ads, premium).
What Types of Purchases Exist in a Game?
| Type | Example | Consumable | Logic |
|---|---|---|---|
| Game currency | 1000 coins | Yes | consume after granting |
| Lives/energy | +5 lives | Yes | consume, avoid duplicates |
| Remove ads | No ads | No | acknowledge, restore |
| Season pass | Battle Pass | Subscription | check expiry |
| One-time content | Character skin | No | acknowledge, restore |
For subscriptions (autoRenewableSubscription) there is separate logic: renewalInfo, grace period, billing retry state. If a subscription expires but the user is still in the grace period, we don't revoke access immediately.
Why Purchase Restoration Matters
StoreKit 2: for await transaction in Transaction.currentEntitlements returns all active non-consumable purchases and subscriptions. A 'Restore Purchases' button is a mandatory element of App Store Review Guideline 3.1.1. Without it, your app will be rejected.
On Android: queryPurchasesAsync(QueryPurchasesParams) for INAPP and SUBS returns all active purchases even without network.
How to Test In-App Purchases Before Release
Use Sandbox testers on iOS and license test accounts on Android. Validate every scenario: successful purchase, cancellation, restoration, repurchase, and offline mode. We always save up to 90% on support costs by catching issues during testing.
Offline and Edge Cases
A user buys something, but the server is unreachable for verification. The correct approach: save a pending transaction locally (Core Data / Room), retry verification on next launch with exponential backoff. Never call finish() on the transaction until successful server verification.
Typical mistakes when integrating IAP:
- Forgetting to acknowledge a purchase on Android—gets refunded in 3 days.
- Not implementing restore on iOS—leads to rejection in review.
- Validating receipt only locally—vulnerable to jailbreak hacks.
- Not handling offline cases—causes lost purchases.
What's Included in the Work
- Product setup in App Store Connect and Google Play Console.
- Server-side receipt verification (Node.js/Python/Go).
- Client IAP module handling all purchase types.
- Testing in Sandbox and Test environment.
- Verification of restore and edge cases.
- Documentation and post-release support.
Work Process
- Analytics and design.
- Product configuration in App Store Connect and Google Play Console.
- Development of server verification.
- Implementation of the client module (StoreKit / BillingClient).
- Sandbox testing.
- Submission preparation and publication.
Estimated Timelines
Basic integration (consumables + non-consumables, server verification): 3–4 days. Subscriptions with grace period, billing retry, receipt migration: +2 days. Cross-platform Flutter/React Native with abstraction over StoreKit and BillingClient: +1–2 days.
Contact us for a project assessment—we guarantee App Store and Google Play review approval. Get a consultation on IAP integration to avoid typical mistakes.