# Video Tutorial: In-App Purchase Part 3: Receipts **URL:** \ **Category:** 🎓 Courses & Articles\ **Created:** [March 4, 2016, 2:31pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127 "2016-03-04T14:31:56Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [March 4, 2016, 2:31pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/1 "2016-03-04T14:31:56Z")
When a user buys an IAP, they are issued with a receipt, which is stored locally on the device. In this video you'll learn how to use validation of these receipts to keep track of which IAPs the user has purchased. * * * This is a companion discussion topic for the original entry at [https://www.raywenderlich.com/4158-in-app-purchase/lessons/4](https://www.raywenderlich.com/4158-in-app-purchase/lessons/4) ---
**Author:** ![larsoleruben](https://s3.amazonaws.com/cdn.raywenderlich.com/community/forum-assets/noun-game-ghost-878668.png) [@larsoleruben](https://forums.kodeco.com/u/larsoleruben)\ **Post date:** [April 23, 2016, 9:35am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/2 "2016-04-23T09:35:55Z")
Hi. I am surprised you don’t mention [receigen](http://receigen.etiemble.com/index.html), which is available on the App Store. It makes the hard stuff for you, but varies the code each time and makes the obfuscation. Thus we don’t have to write any code in C to make it work. ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [May 2, 2016, 7:29am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/3 "2016-05-02T07:29:25Z")
Thanks for the recommendation. I was wary of recommending anything too strongly, but this looks great. sam ---
**Author:** ![dgriffin](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/dgriffin/32/81494_2.png) [@dgriffin](https://forums.kodeco.com/u/dgriffin)\ **Post date:** [October 17, 2016, 8:45pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/4 "2016-10-17T20:45:19Z")
Hi @samdavies , in video you have used RMStore to validate receipt, which in turn uses openssl. I am planning to use SwiftyStorekit for IAP, do u think receipt validation in SwiftyStorekit is as powerful as openssl? and is it in accordance with Apple’s recommendation of implementing receipt validation? ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [October 18, 2016, 2:05am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/5 "2016-10-18T02:05:20Z")
@dgriffin I’ve not used **SwiftyStoreKit** , but it looks like it has a nice API. However, a brief perusal of the code around receipt validation suggests that it uses a technique that Apple specifically recommends against using. [https://github.com/bizz84/SwiftyStoreKit/blob/master/SwiftyStoreKit/InAppReceipt.swift#L181-L267](https://github.com/bizz84/SwiftyStoreKit/blob/master/SwiftyStoreKit/InAppReceipt.swift#L181-L267) There are 2 ways of doing receipt validation - 1 is to confirm the receipts cryptographic signature. This can be done independently, and hence on device. The second is to contact the App Store servers and request them to confirm a receipt is valid. This second way is significantly easier to implement, but is not appropriate for use on device. This is because as a developer you cannot guarantee the security of either end of the connection. Apple specifically recommends against this in their docs: ![](https://raywenderlich-com-v3-forums.s3.amazonaws.com/original/3X/9/c/9c44cf124c99139c1ab2a60985d7da227304cc8e.png) (via [Apple Developer Documentation](https://developer.apple.com/library/content/releasenotes/General/ValidateAppStoreReceipt/Chapters/ValidateRemotely.html)) It’s therefore recommended to only use this approach for server-App Store communications - where you can guarantee the authenticity of one end of the communication. SwiftStoreKit uses this approach to validate receipts. As I said, it’s significantly easier to implement, but much less difficult to spoof. Therefore, in the video I used RMStore and openssl to perform the receipt validation procedure. This is appropriate for use on device. As with everything, it becomes a risk-reward problem. It’s up to you to decide the risk of people spoofing your IAP receipt validation against the cost to you. It’s still not trivial to spoof receipt validation with the remote approach, but it is significantly easier than with the cryptographic signing. Hope that helps - sorry it became a overly long braindump 😕 sam ---
**Author:** ![dgriffin](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/dgriffin/32/81494_2.png) [@dgriffin](https://forums.kodeco.com/u/dgriffin)\ **Post date:** [October 18, 2016, 2:34am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/6 "2016-10-18T02:34:13Z")
Thanks @samdavies for detail explanation and quick reply 🙂 This is really helpful. ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [October 18, 2016, 2:46am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/7 "2016-10-18T02:46:13Z")
@dgriffin my pleasure 🙂 ---
**Author:** ![createch](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/createch/32/109646_2.png) [@createch](https://forums.kodeco.com/u/createch)\ **Post date:** [December 10, 2016, 6:56am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/8 "2016-12-10T06:56:40Z")
I find this all quite overwhelming. My last two apps have been freemium with in-app purchases. It is working well for me. I have a couple of older apps that I want to convert from paid to freemium with in-app purchases. I am having real difficulty figuring out how to locally validate the receipt for date of purchase and version purchased so that I can give those previous owners credit for the in-app purchase. There is lots of information out there, but nothing that is detail enough and step-by-step for me with Swift 3. Getting and compiling OpenSSL as well as adding this to my Xcode project is beyond my current ability so if anyone has a step-by-step tutorial available, or in the works I am sure I, and others would very much appreciate this. ---
**Author:** ![macmacland](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/macmacland/32/53034_2.png) [@macmacland](https://forums.kodeco.com/u/macmacland)\ **Post date:** [January 12, 2017, 7:05pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/9 "2017-01-12T19:05:08Z")
There’s a challenge video mentioned, but I don’t see it. The video length says 20 minutes, but it’s only 11. ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [January 31, 2017, 9:16am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/10 "2017-01-31T09:16:40Z")
@macmacland Apologies for the missing video. I’m trying to find out where it got to. sam ---
**Author:** ![scmiyer](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/scmiyer/32/110937_2.png) [@scmiyer](https://forums.kodeco.com/u/scmiyer)\ **Post date:** [September 10, 2018, 2:58am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/11 "2018-09-10T02:58:05Z")
Hi, I see that you distribute openssl as a pre-compiled binary in the project (libssl\_IOS.a). Did you build this binary yourself? Is it safe to use this in a production app? I ask because it is recommended that you build the binaries yourself. ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [September 10, 2018, 3:28pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/12 "2018-09-10T15:28:47Z")
Hey @scmiyer It’s a while since I made this video, but I’m pretty sure I mentioned that you should not include this pre-built binary in your app. This is especially true now that the binary that’s part of this sample app is over 2 years old. I distributed it as a binary here because I wanted to concentrate on the mechanics of receipt authentication, without having to go into detail about how to compile libSSL yourself. Sadly, you’ll have to do this as part of distributing your own production app. Hope that clears things up a little sam ---
**Author:** ![scmiyer](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/scmiyer/32/110937_2.png) [@scmiyer](https://forums.kodeco.com/u/scmiyer)\ **Post date:** [September 11, 2018, 2:52am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/13 "2018-09-11T02:52:42Z")
No worries. Thanks for the reply. ---
**Author:** ![krikri](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/krikri/32/109074_2.png) [@krikri](https://forums.kodeco.com/u/krikri)\ **Post date:** [April 4, 2019, 4:09pm UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/14 "2019-04-04T16:09:13Z")
I am witnessing the following (in sandbox): • User A purchases my auto-renewing subscription • User A logs out of iTunes & App Store • User B logs in, receipt is still there on next app launch and exactly the same, so he still uses User A’s subscription. Will the receipt be ever updated to show User B’s subscription state? How do we handle this case? Thanks in advance. ---
**Author:** ![samdavies](https://assets.chunter.kodeco.com/user_avatar/forums.kodeco.com/samdavies/32/111915_2.png) [@samdavies](https://forums.kodeco.com/u/samdavies)\ **Post date:** [April 5, 2019, 7:29am UTC](https://forums.kodeco.com/t/video-tutorial-in-app-purchase-part-3-receipts/7127/15 "2019-04-05T07:29:27Z")
Hi @krikri I’m really sorry, but I just don’t know the answer to that. It’s been a while since I first created this course. However, we’ve recently released a much more in-depth course on IAP, which might answer your questions: [https://www.raywenderlich.com/1304447-in-app-purchases](https://www.raywenderlich.com/1304447-in-app-purchases) Or hopefully somebody else on the forums will be able to answer your question. cheers sam