GitHub Repo

• Contains these projects:
  • iOS-App (The iOS app that could be used to test the in-app purchase)
  • services-key-generator (a helper app that generates JWT for App Store content and server APIs)
  • app-store-server-library (Apple demo app that could be used to trigger various events in server to server notifications)
  • backend-server (the actual server, that will receive server-2-server notifications from Apple App Store server)

Creating application bundle in App Store connect

1. Click + in `https://appstoreconnect.apple.com/apps`
2. Create bundle identifier
   refer to Apple documentation for more details
3. on ‘Platforms’ select iOS
4. Add bundle identifier name (preferably following this pattern (com.MyCompany.appName)

Create new Application in App Store Connect

https://appstoreconnect.apple.com/apps

1. Select New App
2. Add the same app bundle that you created.
3. Make sure that on `platforms` you select iOS

Create products in App Store connect.

Once you create application, you have to create some products to sell.

In general there are these types of products supported by Apple’s App Store:

• Consumables.
  • Consumables are products that can be used (‘consumed’) once and then repurchased multiple times.
• Non-consumables
  • Non-consumables are products that are purchased once, have no expiry date, and remain permanently available within your app.
• Auto-renewal subscriptions
  • Auto-renewal subscriptions are products or services that you pay for on a recurring basis. Developers love these, as they guarantee a steady income stream.
• Non auto-renewal subscriptions.
  • Non auto-renewal subscriptions are those that run for a fixed period of time, after which you can choose to manually renew. Often, these last longer and cost more than auto-renewal subscriptions.

To create products navigate to the newly created app, and locate “MONETIZATION” on the left side. From there you could select to create “in-app-purchases” or “Subscriptions”

Refer to Apple documentation of how to create products: In-App purchase

Creating Sandbox testing users

Ahh, yeah … you need test users so you won’t be charged with each test.

Refer to Apple documentation of how to create Sandbox test users

• navigate to “users and access” -> sandbox
• Click the “+” sign to create a new sandbox tester.

Set up your physical phone to use Sandbox test users

In order to test in-app purchase you have to deploy the app to the real device. Won’t work on the simulator.

In order to not be charged on every purchase test, you need to set up a Sandbox test users and set your physical iPhone to use them.

1. Set up Sandbox test users (described above)
2. On your physical phone navigate to Settings->App Store->SANDBOX ACCOUNT and add the new Sandbox user email there.

Make sure that you already enabled Developer mode on the iPhone

Creating the iOS app in X-Code

1. Create new Xcode project and change the bundle id to the one that you set up above in the app store connect. (Refer to Creating application bundle in App Store connect in this article.)
2. In-app purchase is not enabled by default. Let’s add it in Signing & Capabilities
   
3. Add mainStore.storekit file by going to files->new and look for StoreKit2.
   
   – Name it mainStore.storekit
   – Make sure that you select ‘synced‘ so it will pull data from the actual App Store and select your apple bundle id (this is how the StoreKit2 will know which items to pull)4. Let’s add another Swift class which will be our shared Store.

store.swift

import StoreKit

@MainActor final class Store: ObservableObject {
    // use the same ids that you defined in the App Store connect
    private var productIDs = ["InAppPurchaseTutorialToniconsumableFuel", "InAppPurchaseTutorialToniConsumableOil", "BrakePads", "InAppPurchaseRenewalPro"]
    private var updates: Task<Void, Never>?
    
    @Published var products = [Product]()
    @Published var activeTransactions: Set<StoreKit.Transaction> = []
    
    init() {
        Task {
            await requestProducts()
        }
        Task {
            await transactionUpdates()
        }
    }
    
    deinit {
        updates?.cancel()
    }
    
    func transactionUpdates () async {
        for await update in StoreKit.Transaction.updates {
            if let transaction = try? update.payloadValue {
                activeTransactions.insert(transaction)
                await transaction.finish()
            }
            }
    }
    
    func requestProducts() async {
        do {
            products = try await Product.products(for: productIDs)
        } catch {
            print(error)
        }
    }
    
    func purchaseProduct(_ product: Product) async throws {
        print("Purchase tapped ...")
        let result = try await product.purchase()
        switch result {
        case .success(let verifyResult):
            print("Purchase successfull!")
            if let transaction = try? verifyResult.payloadValue {
                activeTransactions.insert(transaction)
                print("PURCHASE:")
                try print(verifyResult.payloadValue)
                print(transaction)
                await transaction.finish()
            }
        
        case .userCancelled:
            print("Purchase Canceled !")
            break
        case .pending:
            print("Purchase pending ...")
            break
        @unknown default:
            break
        }
    }
    
    func fetchActiveTransactions() async {
        var activeTransactions: Set<StoreKit.Transaction> = []
        for await entitelment in StoreKit.Transaction.currentEntitlements {
            if let transaction = try? entitelment.payloadValue {
                activeTransactions.insert(transaction)
                print("fetchActiveTransactions: ")
                print(transaction)
            }
        }
    }
}

In productIDs use the same ids that you defined in the App Store connect.

We define simple class that could be used in each View to retrieve purchases, make purchases, and update all views that is using it.
View updates happen since the class comforting to the ObservableObject protocol.

5. Edit the View to add purchase buttons.

Views/ContentView.swift

//
//  ContentView.swift
//  InAppPurchaseTutorial
//
//  Created by Toni Nichev on 1/2/24.
//

import SwiftUI
import StoreKit

struct ContentView: View {
    @EnvironmentObject var store: Store
    
    var body: some View {
        

        VStack {
            Text("Welcome to my store").font(.title)
            ProductView(id: "InAppPurchaseTutorialToniconsumableFuel") {
                Image(systemName: "crown")
            }
            .productViewStyle(.compact)
            .padding()
            .onInAppPurchaseCompletion { product, result in
                if case .success(.success(let transaction)) = result {
                    print("Purchased successfully: \(transaction.signedDate)")
                } else {
                    print("Something else happened")
                }
            }
        }
        
        Section(header: Text("To buy:").font(.title)) {
            ForEach(store.products, id: \.id)  { product in
                Button {
                    Task {
                        try await store.purchaseProduct(product)
                    }
                } label: {
                    HStack {
                        Text(product.displayName + ":")
                        Text(verbatim: product.displayPrice)
                    }
                }
                .buttonStyle(.borderedProminent)
            }
        }
    }
}

#Preview {
    ContentView().environmentObject(Store())
}

6. Last part is to add method to retreive purchases when the application starts.

InAppPurchaseTutorialApp.swift

//
//  InAppPurchaseTutorialApp.swift
//  InAppPurchaseTutorial
//
//  Created by Toni Nichev on 1/2/24.
//

import SwiftUI

@main
struct InAppPurchaseTutorialApp: App {
    @Environment(\.scenePhase) private var sceneParse
    @StateObject private var store = Store()
    
    var body: some Scene {
        WindowGroup {
            ContentView()
                .environmentObject(store)
                .task(id: sceneParse) {
                    if sceneParse == .active {
                        await store.fetchActiveTransactions()
                    }
                }
        }
    }
}

Setting up Backend server to listen to server-2-server notifications from Apple server

Apple server sends server-to-server notifications in real time when subscription event happens, like subscribed, cancel subscription, did renew etc.

Mode details of all notification types could be found in Apple documentation

Purpose: we can receive these notifications on transaction complete, on purchase made, on subscriptions: purchased, canceled, failed and we could grant access to subscribers to some paid services like (pro news, premium game levels etc.)

1. Download AppleRootCA-G3.cer
2. Convert certificate to PEM to use it in the PHP script below:
   On MacOS you could navigate to the downloaded certificate and execute:

   openssl x509 -in AppleRootCA-G3.cer -out apple_root.pem

3. Copy the newly created PEM file to the root folder of the backend server handler, under ./assets folder.
4. Create your backend server handler, that Apple App Store server will notify.
   I like to use PHP version cause it’s super easy to implement but any language works the same way:index.php

   <?php
   header('Status: 200');
   header("HTTP/1.1 200 OK"); 
   
   ini_set('display_errors', 1);
   error_reporting(E_ALL);
   
   
   // Download the certificate -> https://www.apple.com/certificateauthority/AppleRootCA-G3.cer
   // Convert it to .PEM file, run on macOS terminal ->  ```bash openssl x509 -in AppleRootCA-G3.cer -out apple_root.pem```
   
   $pem = file_get_contents('./assets/apple_root.pem');
   // $data = file_get_contents('./test.json'); // replace with file_get_contents('php://input');
   $data = file_get_contents('php://input'); // replace with file_get_contents('php://input');
   $json = json_decode($data);
   
   file_put_contents("./beep.txt", PHP_EOL . $data . PHP_EOL, FILE_APPEND);
   
   $header_payload_secret = explode('.', $json->signedPayload);
   
   //------------------------------------------
   // Header
   //------------------------------------------
   $header = json_decode(base64_decode($header_payload_secret[0]));
   
   $algorithm = $header->alg;
   $x5c = $header->x5c; // array
   $certificate = $x5c[0];
   $intermediate_certificate = $x5c[1];
   $root_certificate = $x5c[2];
   
   $certificate =
         "-----BEGIN CERTIFICATE-----\n"
       . $certificate
       . "\n-----END CERTIFICATE-----";
   
   $intermediate_certificate =
         "-----BEGIN CERTIFICATE-----\n"
       . $intermediate_certificate
       . "\n-----END CERTIFICATE-----";
   
   $root_certificate =
         "-----BEGIN CERTIFICATE-----\n"
       . $root_certificate
       . "\n-----END CERTIFICATE-----";
   
   //------------------------------------------
   // Verify the notification request   
   //------------------------------------------
   if (openssl_x509_verify($intermediate_certificate, $root_certificate) != 1){ 
       echo 'Intermediate and Root certificate do not match';
       exit;
   }
   
   // Verify again with Apple root certificate
   if (openssl_x509_verify($root_certificate, $pem) == 1){
       
       //------------------------------------------
       // Payload
       //------------------------------------------
       // https://developer.apple.com/documentation/appstoreservernotifications/notificationtype
       // https://developer.apple.com/documentation/appstoreservernotifications/subtype
   
       $payload = json_decode(base64_decode($header_payload_secret[1]));
       $notificationType = $payload->notificationType;
       $subtype = $payload->subtype;
   
       
   
       $transactionInfo = $payload->data->signedTransactionInfo;
       $ti = explode('.', $transactionInfo);
       
       $data = json_decode(base64_decode($ti[1]));
   
       // var_dump($payload); // this will contain our originalTransactionId
       file_put_contents("./data.txt", PHP_EOL . PHP_EOL . '=====================================' . PHP_EOL, FILE_APPEND);
       file_put_contents("./data.txt", print_r($payload, true),  FILE_APPEND);
       file_put_contents("./data.txt", '-------------------------------------' . PHP_EOL, FILE_APPEND);
       file_put_contents("./data.txt", print_r($data, true), FILE_APPEND);
   
       if($notificationType == "SUBSCRIBED") {
       }
       if ($notificationType == "EXPIRED" || $notificationType == "REFUND") {
       }
   } else {
       echo 'Header is not valid';
       exit;
   }
   

   what we just did:
   – decoded JWT
   – Saved the decoded response in the data.txt file
   so far so good, but we need to register our server-listener to the App-store connect so the Apple server will notify our server.

   Now it’s a good time to testing with curl command and make sure that the script reads POST body data.

   curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' https://yourserver.com/app-store-server-notification-tutorial/

   After executing the command look at ./beep.txt file for the raw response. If you see it, you are ready to continue with a real test notification from Apple server.

5. Add your backend server url to Apps’ App Store Server notifications
   

Once server is set up you could issue test notification by following this tutorial from Apple.

If test notification is successful too, you could finally issue a real notification by doing test purchase from the app.

Now we could navigate to the physical phone, run the app and make a purchase.
Make sure that once prompted for the password you add the test account password.

The payload will look like this:

{
  "bundleId" : "com.toninichev.Blue.InAppPurchaseTutorial",
  "currency" : "USD",
  "deviceVerification" : "fewrfewwg5y334wPOJMZrp40ih0WW\/rwlc2fRsYqixrsB9g",
  "deviceVerificationNonce" : "7dfggrtrq6-9bec-4811-af53-edsfdfe675d4",
  "environment" : "Sandbox",
  "expiresDate" : 1704816065000,
  "inAppOwnershipType" : "PURCHASED",
  "originalPurchaseDate" : 1704479596000,
  "originalTransactionId" : "2000000494141906",
  "price" : 990,
  "productId" : "InAppPurchaseRenewalPro",
  "purchaseDate" : 1704815765000,
  "quantity" : 1,
  "signedDate" : 1704815791564,
  "storefront" : "USA",
  "storefrontId" : "143441",
  "subscriptionGroupIdentifier" : "21429665",
  "transactionId" : "2000000496365380",
  "transactionReason" : "PURCHASE",
  "type" : "Auto-Renewable Subscription",
  "webOrderLineItemId" : "2000000047529194"
}

At the same time our backend server should have received server-2-server notification that purchase was made that will look like this:

[notificationType] => SUBSCRIBED
[subtype] => RESUBSCRIBE
[notificationUUID] => b19f4a0f-5e0b-4092-8286-0ceb29ed757f
[data] => stdClass Object
    (
        [appAppleId] => 6475326521
        [bundleId] => com.toninichev.Blue.InAppPurchaseTutorial
        [bundleVersion] => 1
        [environment] => Sandbox
        [signedTransactionInfo] => eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTURD ...
        [signedRenewalInfo] => eyJhbGciOiJFUzI1NiIsIng....
        [status] => 1
    )

[version] => 2.0
[signedDate] => 1704815828988

and the decoded transaction info:

[transactionId] => 2000000496365380
[originalTransactionId] => 2000000494141906
[webOrderLineItemId] => 2000000047529194
[bundleId] => com.toninichev.Blue.InAppPurchaseTutorial
[productId] => InAppPurchaseRenewalPro
[subscriptionGroupIdentifier] => 21429665
[purchaseDate] => 1704815765000
[originalPurchaseDate] => 1704479596000
[expiresDate] => 1704816065000
[quantity] => 1
[type] => Auto-Renewable Subscription
[inAppOwnershipType] => PURCHASED
[signedDate] => 1704815827353
[environment] => Sandbox
[transactionReason] => PURCHASE
[storefront] => USA
[storefrontId] => 143441
[price] => 990
[currency] => USD

Create API keys generator

Now we have server-2-server notification set up, but if we want to use more of Apple’s APIs (like transaction history, purchases, etc) we have to create an app to generate signed JWT.
Apple won’t accept JWT that lives longer than 20 min. so we have to make sure that this is the maximup ttl that we set up.

const expirationTime = now + 900; // Set to 15 minutes (900 seconds)

There are two types of Apple APIs like it was stated above:

import jwt from "jsonwebtoken";
import fs from "fs";

const now = Math.round(new Date().getTime() / 1000);
const expirationTime = now + 900; // Set to 15 minutes (900 seconds)

export default async (keyId, issuerId, privateKeyFileLocation, bundleId) => {

    const privateKey = fs.readFileSync(privateKeyFileLocation);

    // Create the JWT header and payload
    const header = {
      'alg': 'ES256',
      'kid': keyId,
      'typ': 'JWT'
    };

    const payload = {
      "iss": issuerId,
      "iat": now,
      "exp": expirationTime,
      "aud": 'appstoreconnect-v1',
    };

    if(bundleId)
        payload["bid"] = bundleId;

    console.log('payload: ', payload);

    // Generate the JWT
    const token = jwt.sign(payload, privateKey, { header: header, algorithm: 'ES256' });

    console.log(`Generated JWT: ${token}`);
    return token;
}

import jwt from "./jwt-generator.js";
import keys from "./keys/keys.js";

function getAppStoreContentApiToken() {
    const keyId = keys.appStoreContentKeyId;
    const issuerId = keys.issuerId;
    const privateKeyFileLocation = keys.appStoreContentPrivateKeyFileLocation;
    jwt(keyId, issuerId, privateKeyFileLocation, null);
}



function getAppStoreServerApiToken() {
    const keyId = keys.inAppPurchaseKeyId;
    const issuerId = keys.issuerId;
    const privateKeyFileLocation = keys.inAppPurchasePrivateKeyFileLocation;
    const bundleId = keys.bundleId;

    jwt(keyId, issuerId, privateKeyFileLocation, bundleId);
}

export default {
    getAppStoreServerApiToken,
    getAppStoreContentApiToken
}

import jwt from "jsonwebtoken";
import fs from "fs";

const now = Math.round(new Date().getTime() / 1000);
const expirationTime = now + 500; // Set to 15 minutes (900 seconds)

export default async (keyId, issuerId, privateKeyFileLocation, bundleId) => {

    const privateKey = fs.readFileSync(privateKeyFileLocation);

    // Create the JWT header and payload
    const header = {
      'alg': 'ES256',
      'kid': keyId,
      'typ': 'JWT'
    };

    const payload = {
      "iss": issuerId,
      "iat": now,
      "exp": expirationTime,
      "aud": 'appstoreconnect-v1',
    };

    if(bundleId)
        payload["bid"] = bundleId;

    console.log('payload: ', payload);

    // Generate the JWT
    const token = jwt.sign(payload, privateKey, { header: header, algorithm: 'ES256' });

    console.log(`Generated JWT: ${token}`);
    return token;
}