Question: Does Apple Purchase Validation Support StoreKit 2 JWS Format?

[utkarshtrivedimdz]

Summary

We're implementing server-side purchase validation for a Godot mobile game using Nakama. For Android, validate_purchase_google_async() works perfectly and stores purchases in the Nakama Console's Purchases section.

For iOS, we're using StoreKit 2 which no longer provides unified receipts. Instead, each transaction has a jwsRepresentation (JSON Web Signature) string.

Question

Does Nakama's Apple purchase validation support StoreKit 2's JWS format?

Client SDK:

var result = await nkc.validate_purchase_apple_async(session, jws_string)

Server Runtime (Go):

validation, err := nk.PurchaseValidateApple(ctx, userID, jwsString, persist, passwordOverride)

Context

StoreKit 1 (Legacy)

• Unified receipt at Bundle.main.appStoreReceiptURL
• Base64 encoded receipt sent to Apple's verifyReceipt endpoint
• verifyReceipt is being deprecated by Apple

StoreKit 2 (Current)

• No unified receipt
• Each Transaction has a jwsRepresentation property
• JWS is self-contained and cryptographically signed by Apple
• Can be verified using Apple's public key or App Store Server API

What We're Trying to Achieve

1. Validate iOS purchases server-side (prevent fraud on jailbroken devices)
2. Store validated purchases in Nakama's purchase ledger (visible in Console UI)
3. Detect replay attacks via seen_before flag

Current Workaround

We're considering a custom RPC that:

1. Receives JWS from client
2. Verifies JWS signature using Apple's certificates
3. Manually writes to storage

But this bypasses Nakama's built-in purchase tracking, losing the Console UI integration.

Environment

• Nakama: Latest (self-hosted via Docker)
• Client: Godot 4.5 with nakama-godot addon
• iOS: StoreKit 2 via SwiftGodot plugin

References

• Apple: StoreKit 2 Transaction.jwsRepresentation
• Apple: Deprecated verifyReceipt
• Nakama IAP Validation Docs

Thank you!

[linear]

NK-1700

[novabyte]

Thanks for the detailed issue notes @utkarshtrivedimdz 🙏 We have this tracked to be implemented but right now have the "modularization" of the IAP/Entitlement system in progress before we can tackle it.

Would you be open to make a code contribution?

[utkarshtrivedimdz]

Yep. Can give it a shot. Let me work on it for a day or two

[Syrul]

Hi, I opened the following PR which adds support, please review it if you can. #2452

[reynoldYang1]

Please consider adding StoreKit 2 signed transaction (JWS) validation support (e.g., Transaction.jwsRepresentation / App Store Server API) as an alternative to verifyReceipt—the receipt flow is often stale for consumables and forces receipt sync/refresh that can trigger extra Apple ID prompts, so StoreKit2 support would greatly improve reliability and UX.