Overview
Validate purchases server-side: obtain a signed transaction history on the client and verify it against the Onside Merchant API.
Last updated
Was this helpful?
Validate purchases server-side: obtain a signed transaction history on the client and verify it against the Onside Merchant API.
To grant entitlements securely, validate purchases on your backend rather than trusting the client alone. OnsideKit produces a signed transaction history that your server verifies against the Onside Merchant API.
Validation has two parts:
On the client — get a signed (JWS) in-app purchase history from OnsideKit and send the relevant order ID (and optionally the JWS) to your backend. See Signed In-App Purchase History.
On your backend — query the Onside Merchant API for the order, verify the signed response, and grant entitlements. See Backend Validation & Merchant API.
To call the Merchant API, obtain a Merchant ID, a Merchant Secret, and a Secret Key ID (kid) from the Onside Manager. These enable secure server-to-server authentication.
Signed In-App Purchase History — the client side
Backend Validation & Merchant API — the server side
Last updated
Was this helpful?
Was this helpful?