Which URL should be used to verify in-App purchase receipts - iphone

I have completed an iPhone application which sells its subscription using IAP and, for that, I have took all the necessary steps and it's working fine.
I just need to know which URL I should used to verify receipts on the server side?
When I was developing the application and testing IAP I was using:
"https://sandbox.itunes.apple.com/verifyReceipt"
Now I have submitted my application and IAP for review, on which environment will Apple test my IAP? Do I need to change the URL to:
"https://buy.itunes.apple.com/verifyReceipt"

Look at Apple's technotes, go to "FAQ" and scroll down to number 15.
it says:
Use the sandbox url
https://sandbox.itunes.apple.com/verifyReceipt
while testing your application in the
sandbox and while your application is
in review.
Use the production url
https://buy.itunes.apple.com/verifyReceipt
once your application is live in the
App Store.

The way Mugunth Kumar did it in his MKStoreKit was:
#ifndef NDEBUG
#define kReceiptValidationURL #"https://sandbox.itunes.apple.com/verifyReceipt"
#else
#define kReceiptValidationURL #"https://buy.itunes.apple.com/verifyReceipt"
#endif
and that's always worked for me. I do that on my app side.
UPDATE:
But here is the actual correct answer from that same Tech Note TN2259 found here:
How do I verify my receipt (iOS)?
Always verify your receipt first with the production URL; proceed to verify
with the sandbox URL if you receive a 21007 status code. Following this
approach ensures that you do not have to switch between URLs while your
application is being tested or reviewed in the sandbox or is live in the
App Store.
Note: The 21007 status code indicates that this receipt is a sandbox receipt,
but it was sent to the production service for verification.
So the right way to do it is to always check the receipt at the live URL first, if you get back a status code of 21007, check it again against the sandbox url. Then you'll know if it was verified or not and if it was verified in the live server or in the sandbox. We send the receipt to our server and this check is done from there, which keeps the user from using a redirection exploit. Then our server sends a secret back to the app if it checks out and records the transaction in a database. Also from here we can track how many hack attempts are happening each day.

Please note that, as #Mark mentioned above, the documentation is incorrect or outdated - I filed a bug report to Apple.
The production URL is with https.
https://buy.itunes.apple.com/verifyReceipt.
You may verify the URL by just requesting it, it should return a JSON string like
{"status":21000}
Cost me two expedited reviews ;)

Related

Why In-App purchase sandbox always ask "Verification Required"?

I have signed out from the store in device settings.
I entered user credentials only in my App.
I have set up a brand new (actually around 4 times) test user.
Why this message keep poppin' up?
Is it something connected to iOS 5, automatic app sync, or iCloud?
I had exactly same problem with sandbox in-app purchases, in built-in model (no receipt verification), app received valid products, now i called addPayment, everything alright. But now "Verification required" appeared and payment was canceled.
After hours of pain I discovered, my problem was in test account.. i created test account for Czech Republic iTunes store... and that was the reason of fail. Dumb.
I tried to create Canadian test user and it suddenly worked! "Verification required" will no longer appeared.
I've dealing with this problem for about one week, trying to use accounts in US/Canada without any success. Finally I found this post and it works:
http://iphonedevsdk.com/forum/iphone-sdk-development/63008-in-app-purchase-test-account-verification-required-cant-get-passed.html
You need a test account that NEVER has a credit card attached to it, NEVER is logged into itunes store or app store via device, and if you do login to itunes or agree to any app store stuff it voids the test account and will never work again.
So, To test your In App Purchase app, you need to use a new account that does not have a credit card. logout of the store, and only use your new account inside the app you are testing.
Update: After a long time system maintenance of iTunes in Sept 2013, only test accounts in US can make test purchases.
I have struggled with this myself, i finally found a workaround that worked for me...
On the device Log out of iTunes account in settings (also hard close settings and iTunes if you have them open as a precaution)
Delete app
Create a new test user at “itunesconnect.apple.com” – selecting the United States as your store
Reinstall app
Try to make a purchase in the app
Enter you new test user account details
If a pop up states that it needs to swap stores, immediately press home. DO NOT press OK.
Relaunch the app, and try again. It should now work as expected.
Hope this works...
In addition of the above answers, note the below points also :-
1) Uninstall your app from the device.
2) Create a new test account on iTunes Connect and verify its email address. Never add any payment information for this test account, not online, not on iTunes, not on your device. Doing so might invalidate your test account (and trigger the "verify payment info" vicious cycle.) Also never use this test account out of the Sandbox.
3) Log-out from the App Store on your device. DO NOT log back in the App Store via Settings > iTunes & App Stores on your device. You will be asked your login credentials from your app later (see points 5-6)
4) Re-install your app.
5) Attempt an in-app purchase. You should now be prompted to enter both your username and password (as you logged out from the App Store)
6) Type in your username and password: you should not see the dreadful "Verification Required: before you can make purchases, you must verify your payment info" message and the purchase should be successful.
Even in sandbox, you need to complete the buy verifying the receipt to the server.
It corresponds to steps 6-7-8 of built-in model and 11-12-13 of the server model.
http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGuide/APIOverview/OverviewoftheStoreKitAPI.html
All you need to do is:
Retrieve the receipt data from the transaction’s transactionReceipt property and encode it using base64 encoding.create a json like this:
{
"receipt-data" : "(receipt in base 64 encoding)"
}
Make a post to verification URL for production:
https://buy.itunes.apple.com/verifyReceipt
For sandbox :
https://sandbox.itunes.apple.com/verifyReceipt
The response is like this:
{
"status" : 0,
"receipt" : { ... }
}
If the value of the status key is 0, this is a valid receipt.
If the value is anything other than 0, this receipt is invalid.
For further information look the guide:
http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGuide/VerifyingStoreReceipts/VerifyingStoreReceipts.html
Swift 3
Insert this temporary code somewhere in your project:
for transaction: AnyObject in SKPaymentQueue.default().transactions {
guard let currentTransaction: SKPaymentTransaction = transaction as? SKPaymentTransaction else {return}
SKPaymentQueue.default().finishTransaction(transaction as! SKPaymentTransaction)
}
This clears out the payment queue. Make sure to run it much later than viewDidLoad if you can. I made mine triggered by a button. Ran it a couple times, then removed the code. No more annoying verification pop-ups.
I saw this issue after iOS5 got released.
Earlier I used to create test accounts with dummy email addresses and it used to work well for me, but post iOS5, it started showing verification required for test accounts.
Thus I ended up using actual email addresses for the test accounts and verified when asked for, which seemed to do the trick for me.
I was facing same problem after spending several hours i figured out that county/region of your itunes connect test account and your device/simulator must be same.
Please verify it as it solved my problem
Register a fresh test user for the USA. You can put any email address.
Log out under settings.
Delete the app.
start it again via xCode
login with your new user within the app.
It may say that you are not located in the USA and it opens the browser, Close the browser and start it again.
It should work now.
If you are having such problem for 4th IAP item to buy.
It looks, each test account does not work for purchasing more than 3 items of an application. You may create a new test account from itunesconnect.apple.com->Manage Users->Test User to test your 4th IAP item.
Creating a canadian test user solve this issue.

How to develop a payment verification for in-app purchase?

I have developed an iPhone application that was rejected. With this application I offer an SMS transmission service. On my website each user has an account and he can buy credits on the website to be able to send SMS.
The reason for rejections was that my app uses an external service, my website. They say I have to use in-app purchase for the credits.
So now I am about to extend my api. So if purchase takes place in-app the web server needs to know that there was a purchase and what type of purchase. This is done using HTTP-POST.
I could build a simple url and register the purchase in the user-account, since I can verify that an purchase was performed correctly in the app store. But to prevent hacking and just for security reason I think there has to be some kind of encryption.
E.g. if the payment process in the app was successful I send a HTTP-POST to my webserver. It contains some encrypted key that can be encrypted by the webserver.
What do you think about all this? How can I make my api safe regarding in-app purchase and what security algorithm could I use?
Any other suggestions or ideas?
You should probably look into the Server Product Model, rather than trying to invent some way for your app on the device to tell the server that credit was purchased after the fact. The section on Verifying Store Receipts will come in handy; in short, your app transmits the contents of transactionReceipt to your server (ideally via HTTPS). Your server base64-encodes it, embeds it in a simple JSON object, and posts it to Apple to get the status and verified purchase information.
I have a complete implementation of storekit including the server code.
http://blog.mugunthkumar.com/coding/mkstorekit-4-0-supporting-auto-renewable-subscriptions/
Try this
You should check out this wiki article on public key encryption. This is what you'll probably what to be using.
CommonCrypto is a module available for iOS that deals with this type of encryption. Here is a sample project in the iOS developer library that uses this module.
Yes You are correct. That is the best way. When user purchase credit using In-App purchase(IAP) You will have delegate method for purchase succeed. So you can call your Server API in this delegate method and put some flag with credit number in the user table of your server database. You can send this info encrypted and your server would decrypt it and insert in your database.

iPhone Store Kit "Cannot connect to iTunes Store"

I am working on adding In-App purchases to my app.
I am able to receive the productsRequest:didReceiveResponse method, and receive the array of products.
My problem arises when I add a SKPayment to the SKPaymentQueue. After I add the product to the queue, in the paymentQueue:updatedTransactions method the transactions always have the state SKPaymentTransactionStateFailed.
I NSLog the "transaction.error" and this is what it returns: Error
Domain=SKErrorDomain Code=0 UserInfo=0x165000 "Cannot connect to
iTunes Store"
I have logged out of the Store in the Settings app, but after trying to purchase a product in my app it never asks me to log in with my test account. It just fails with the above error.
I was getting SKPaymentTransactionStateFailed error code 0 "Cannot connect to iTunes Store" and thanks to thomax for this answer my problem is solved. Turns out you MUST enter a build number under Targets->Summary.
I spent the last 24 hours resetting my phone, screwing with iTunes connect, and doing just about everything i could think of before i stumbled upon this solution.
I assume you've done the standard sanity checks: double-checking your code, confirming your product IDs, comparing your code to the In-App Purchase Programming Guide, etc.
This may be ridiculous, but -- if you're certain your code is correct -- do a hard reset (full wipe) of your iPod (Settings => General => Reset => Erase All Content and Settings). I puzzled over this exact problem for hours -- it turned out my code was correct and the hard reset was the solution.
I had been getting the same error but I had been prompted for my test user account. And also a popup saying "An unknown error has occurred". It turns out that when I created my test user account and signed out of the settings -> store I had decided to sign in with my test user account which had prompted me for a bunch of information including billing, which had broken my test user account. When I created a new test user account and only signed in when prompted to during the in app purchase testing, everything worked smoothly.
This error (i.e. "Error! Cannot connect to iTunes Store") can occur if you do a sandboxed In App purchase but are signed in using your normal Apple account.
I find it helps avoid any confusion if I sign out of my Apple account before doing any In App purchases. Then in the "Sign In" dialog choose the "Use Existing Apple ID" option and enter your Test User details.
Just remember this will be set in your Settings so you will need to sign out after you've finished In App purchases.
Also, using a different Apple ID resets various iTunes-related settings such as iTunes Match.
You can check if the following link is working or timing out:
https://sandbox.itunes.apple.com/verifyReceipt
Alternatively, an unscientific but quite reliable way to check if the sandbox is working is to ask at:
https://devforums.apple.com/community/ios/connected/purchase
If the sandbox is down, there will probably be people already talking about it, like now (18 Jan 2012, 6:40pm UTC time).
I also was facing with the same error.
I figured out, that the Error only comes on the Simulator, when I switched to the device debugging, the error didn't appear.
Simply log off from your AppStore account on settings...
Solved the problem for me because my device was logged using my regular Apple ID and because the purchases on the sandbox are always done with the test user ID, the device was trying to send my regular Apple Store ID to the "test" App Store resulting on this "Cannot Connect to iTunes Store" error.
This is the most common cause I have seen on my device.
Hit with the same problem, i reset my device, cross verified the identifiers, re-installed the app. Also thought the problem was, because I had changed the reference and the description of the products. In reality, I feel it is because my test user had got locked as multiple people where using the same account, and it is a possibility that the password validation failed multiple times.
So I re-created another test user and in-app purchasing is back to working.
Hope this helps. I was totally stumped with this error.
Make sure your BundleIDs match. That was my problem.
Even a full restore did not resolve this problem for me.
After calling addPayment for an auto-renewing product identifier, about one second passed before I received the "SKErrorDomain Code=0" error from StoreKit. At no point was I prompted (as Apple's documentation suggests one should be) for an iTunes Store username and password; the transaction simply failed.
To resolve this, I had to add a fake "consumable" product to iTunes Connect and call addPayment using the fake consumable's product identifier. This caused the iTunes Store dialog to come up. I then logged in with a test account I had created in iTunes Connect. This succeeded: my application was notified that the consumable had been purchased.
After having done this, I was able to call addPayment with my auto-renewing product identifier and purchase the subscription normally.
make sure you're testing with sandbox user accounts created from itunesconnect and not your actual apple id for your personal account when testing this stuff.
I thought it worth mentioning that DonnaLea's solution of only logging in when prompted for payment also worked for the same issue with Unity and Prime31's StoreKit plugin.
Attempting to log in via the same settings menu you use to log out will prompt for all manner of billing\address details which seems to permanently "break" that test account.
I found myself in this situation when I was working on adding in-app purchases and didn't do it exactly right the first time. In my case I had an error in server-side PHP and as a result I think I wasn't getting all the way through to "finishTransaction:". Even after I fixed the problems (I put the program on a separate device and purchased successfully), I kept getting "You've already purchased this, click to download" followed by "Cannot connect to iTunes Store".
I finally got it to stop doing that by launching the game from Springboard (not XCode). It immediately processed the transaction successfully and stopped prompting me to redownload.
This is similar to the accepted answer above. I started getting the "cannot connect to iTunes store" error when trying to log in to my iTunes account on my phone after logging in with an IAP sandbox account.
To solve the problem, I was able to just do a Reset All Settings instead of Erase All Content and Settings (Settings => General => Reset => Reset All Settings). Definitely better than having to lose and reinstall everything on your device.
I had had the same problem, first of all I haven't created test account so I created via getting help from this link
https://developer.apple.com/library/ios/documentation/LanguagesUtilities/Conceptual/iTunesConnect_Guide/Chapters/SettingUpUserAccounts.html#//apple_ref/doc/uid/TP40011225-CH25-SW10
Then You need to sign out from your current account on your device. and buy purchasing it will ask for user account, then enter the test account.
I had this same issue. I had previously created a test user account, and signed out of the itunes store expecting to be prompted with a sign in for my test user account when I made the in app purchase. instead I got the cannot connect to itunes store message. when I signed in with my real itunes username/password and tried my test app it worked perfectly. I then logged out of itunes store again and my app worked great, prompting me for my id/pw
I had the same error, but the problem was not exactly the same. Maybe usefull for someone:
I inserted an external file in the structure of my app. The reason why I did this is because in production, I insert this file dinamicaly from a server, but in development I thought it was faster to use an app called iExplorer to paste this file. I have done this is the past and I didn't have this problem. But in the last few days, if I paste this file directly using iExplorer, my app returns the error: "Cannot connect to iTunes Store". (in spanish: "No puede conectarse a iTunes Store").
I think that it is because this time I inserted the file inside the .app folder. So this makes me think that if you modify your .app folder in any way, the Codesignature breaks and the link with the iTunes Store stops working directly.
For me, the problem was fixed by uploading a binary. Since that answer was not given in this page, which seems to be among the top hits in Google, I thought I'd add it.
Figured I should share my recent experience with the same issue:
I experienced the same problem a few days ago, where it stopped working from one day to the other. I got the following error after having authenticated with my test user(s): Error Domain=SKErrorDomain Code=0 UserInfo=0x165000 "Cannot connect to iTunes Store"
I hadn't done any changes to the code and we couldn't think of any other changes to our iTunes account or IAP products that might've triggered the problems. The only thing that may have been related was the adding of more iTunes Test Users (although I've added ~15 accounts before without problems). I tested it on different devices and the simulator.
I went through all the available checklists and all possible solutions (everything mentioned above as well) without any success. Finally I figured I might as well take a break from it all over the weekend, since I was drawing blanks. And oddly (and for the first time ever), doing nothing actually worked!
I didn't change any code, nor did anything change on our iTunes account or the app.
The only reasons I can think of are:
Something was wrong on Apple's end.
Some other time-based factor with the app, a certificate or something caused the problems.
A leprechaun snuck into my office and fixed the issue.
Check if you are signed into your personal itunes account in the appstore. If you are you will receive this message. Even if you are signed into your sandbox account in the app. So, to resolve this issue sign out of your personal account in the app store and then try to purchase your in-app item and then use your sandbox account. This resolved my issue.
Well, as usual I "tried all solutions available and it didn't help" :)
So, here is my input to this unlimited collection of stumble stones:
If application is not currently on sale (at any reason), this error occurs.
I got the same error,
When I called SKProductsRequest's start method in my test env,
It ran in
- (void)request:(SKRequest *)request didFailWithError:(NSError *)error
When I called in my production env,
It's correct and ran in
- (void)productsRequest:(SKProductsRequest *)request didReceiveResponse:(SKProductsResponse *)response
Close charles or any http proxy software asap!
Close charles or any http proxy software asap!
Close charles or any http proxy software asap!
You know it~
I had had the same problem, but I solved by the following mode:
- I was using iPhone 5S emulator with iOS 8.4 (This is the most important. Apple Store connection is not working on iOS 11 emulator)
- on emulator I turned on the following setting: Settings/Developer/Allow HTTP services (This is for internet connection)
- temporarily I turned off Avast antivirus Web Shield (This is for internet connection too)
The In-App Purchase FAQ has this information:
Cannot connect to iTunes Store
The "Cannot connect to iTunes Store" issue may be due to one or more of the following reasons:
The sandbox may be unreachable.
Your app does not have a bundle version (CFBundleVersion). See Setting the Version Number and Build String for more information.
Your app is running in the Simulator, which does not support in-app purchase.
You are attempting to purchase a product that is unavailable for sale. See Query the App Store for product information before presenting your app’s store UI for more information.
In my case, the error occurred because I was using the simulator.
Even in the In-App Purchase Programming Guide says to use the development iOS device has a suggested testing step.
As Apple's Documentation:
Cannot connect to iTunes Store
The "Cannot connect to iTunes Store" issue may be due to one or more of the following reasons:
The sandbox may be unreachable.
Your app does not have a bundle version (CFBundleVersion). See Setting the Version Number and Build String for more information.
Your app is running in the Simulator, which does not support in-app purchase.
You are attempting to purchase a product that is unavailable for sale. See Query the App Store for product information before presenting your app’s store UI for more information.
https://developer.apple.com/library/content/technotes/tn2413/_index.html
I have tried all what I can to deal with this issue.
Real device not Simulator.
New registered Sandbox test account (not fill the extra info to make it a formal Apple ID)
Logout whatever accounts related.(iCould, App Store, maybe other app's sandbox testing account)
Fill all the tax and Agreements in itunesconnect website
Even restore to factory settings LOL
...
always return SKErrorDomain Code=0
“Cannot connect to iTunes Store”
...
My case's solution is finally come tome after 3 days' struggle:
And finally I find the key. Try with another device to test the iAP if your device's iOS is iOS13.4.x!!!And I upgrade this ”broken“ device's OS version to iOS14.0.1, iAP works like a charm.

In App Purchase Verify certificate problem

I am getting the response as below.
{"status":21002, "exception":"java.lang.NullPointerException"}
I am encoding the receipt using Base64 only.
I am testing it in sandbox.
What will be the problem? Can anyone help me?
hi all i got the solution
just send the receipt data after encoding into base 64 as json with key "receipt-data"
VIP Worth noting that 21002 is also the message you get back when trying to verify a transaction that was initiated via rooted iTunes hack software like the Urus app.
We verify all transactions server side, so are not device dependant, the only transactions that get the 21002 response are ALL not real payments.
an easy way to spot it to look at the transaction id returned Urus gives com.urus.iap.XXXXXXX (x being random numbers), other ones include returning the pack name as the completed transaction id, all very different to the id's you get from the various iTunes servers.
I can't recommend more that everyone verifies server-side in an environment you can control, test and prove, that cant be manipulated (unless your hacked). If this is not an option, then do not pay out on a 21002 response.
verifying in a java environment the json response for the 21002 will be:
json: {"status":21002,"exception":"java.lang.ClassCastException"}
We had the same problem - until we discovered that we didn't include the post body in the request and only sent an empty request.
The only option that work for me after 2 days of hitting my head against the wall:
Testing in the sandbox
Pay attention to this advice by apple
"Important Do not sign in with your test account in the Settings application."
Make sure on the test device you are signed out of the "test" apple store account before encoding to base 64.

IPHONE in-app purchase: is it possible to verify a receipt without using an external server?

I have a receipt of a recorded transaction stored by the application when the transaction was done and I would like to ask apple's servers if this receipt is valid.
Is there a way to do this without using an external server?
I would like to ask Apple's servers if this receipt is valid.
Is there a way to do this without using an external server?
Perhaps it's just me, but it seems like you are asking to contact a server without contacting a server, which is quite impossible I'm afraid.
As far as I know, there are few json service provided by Apple:
One for the In App sandbox (before the submission):
https://sandbox.itunes.apple.com/verifyReceipt
One for the App Store version:
https://buy.itunes.apple.com/verifyReceipt
You can call them sending your receipt:
{
"receipt-data" : "(actual receipt bytes here)"
}
And it returns the answer:
{
"status" : 0,
"receipt" : { ... }
}
I assume you can make a direct call to the service within your iPhone app OR you can call your own server script that work as a proxy to the Apple service. It depends on your app logic. If you need to check the receipt on your server (IE. to authorize a download) you should call your server script otherwise you can verify the receipt directly from the app.
Doc reference:
http://developer.apple.com/library/ios/#documentation/NetworkingInternet/Conceptual/StoreKitGuide/VerifyingStoreReceipts/VerifyingStoreReceipts.html
this case is solved. It is possible to do that using just the iphone.
To clarify:
Only the Apple Server can give information about the validity of a
transaction receipt. Indeed you have to contact this server even just
to find out if a product is still active (or if the user has
cancelled the subscription).
On the web, you get the impression that
it is not at all, or at least not in any safe way, possible to
contact this Apple Server simply via HTTP-POST out of your app.
Everybody seems to be convinced you need to have a web server which
is contacted from your app, and that you should only contact Apple's
server from your web server.
Apple, however, even provides implementation code (I wish I had found that earlier) on how to contact the verification server safely without another web server in between:
http://developer.apple.com/library/ios/#releasenotes/StoreKit/IAP_ReceiptValidation/_index.html
This implementation is similar to what lomanf mentioned, just in more detail and with all the security needed to make it work even with iOS 5.x.
So the answer is most definitely: Yes.