Receipt Validation

Receipt validation is an important security measure for Unity In-App Purchases (IAP). It helps verify that a purchase was actually completed through Google Play or the Apple App Store and wasn't generated by a modified client or fake purchase request.

While Unity IAP simplifies the purchasing process, production games should always validate receipts before granting high-value rewards or premium content.

This guide explains what receipt validation is, why it matters, and the different validation approaches available.

Before You Begin

Complete the previous guides before continuing:

What is a Receipt?

Whenever a purchase is completed successfully, the app store generates a receipt.

A receipt contains information about the transaction, including:

Product ID
Transaction ID
Purchase Time
Store Name
Purchase Status
Store Signature

Think of a receipt as proof that the transaction actually occurred.

Why Validate Receipts?

Without receipt validation, a modified game client could pretend a purchase was successful without completing a real payment.

Receipt validation helps protect your game from:

Fake purchases
Modified APKs
Unauthorized premium unlocks
Subscription abuse
Fraudulent transactions

Although no client-side system is completely secure, receipt validation significantly improves the integrity of your purchasing workflow.

Validation Methods

There are two common approaches to receipt validation.

Local Validation

The game validates receipts directly on the player's device.

Advantages:

Easy to implement
Works offline after purchase
Faster response

Limitations:

Less secure
Can be bypassed on compromised devices

Local validation is suitable for many indie games with low-risk purchases.

Server-Side Validation

The game sends the receipt to your own backend server.

Typical workflow:

Purchase Complete
        │
        ▼
Receive Receipt
        │
        ▼
Send Receipt to Server
        │
        ▼
Server Verifies with Store
        │
        ▼
Server Returns Result
        │
        ▼
Grant Reward

Advantages:

Much more secure
Harder to manipulate
Better fraud protection
Centralized purchase records

Recommended for games with subscriptions or high-value purchases.

Accessing the Receipt

Unity IAP provides access to the purchase receipt after a successful transaction.

Example:

string receipt = product.receipt;

Debug.Log(receipt);

The receipt can then be validated locally or sent to your backend server.

Grant Rewards After Validation

A recommended purchase flow is:

Purchase Success
        │
        ▼
Retrieve Receipt
        │
        ▼
Validate Receipt
        │
        ▼
Grant Player Reward
        │
        ▼
Save Player Data

Avoid granting premium content before the receipt has been verified.

Handle Validation Failures

If receipt validation fails:

Do not grant the purchased item.
Inform the player that verification failed.
Allow the player to retry later if appropriate.
Log the failure for troubleshooting.

Example user-friendly message:

"We couldn't verify your purchase at this time. Please try again in a few moments."

Avoid exposing technical details to players.

Testing Receipt Validation

Before publishing:

Test valid purchases.
Test restored purchases.
Test cancelled purchases.
Test invalid Product IDs.
Test sandbox environments.
Test offline scenarios.
Verify rewards are only granted after successful validation.

Best Practices

Follow these recommendations:

Validate every premium purchase.
Use server-side validation whenever possible.
Store transaction IDs for future reference.
Never trust client data alone.
Keep Product IDs consistent.
Log validation failures for debugging.

Common Mistakes

Avoid these common issues:

Granting rewards before validation.
Ignoring failed validation.
Assuming all receipts are valid.
Exposing sensitive receipt information in logs.
Skipping validation for subscriptions.
Trusting modified client data.

Production Tips

For production games:

Use HTTPS for all server communication.
Validate receipts on a secure backend.
Store transaction history.
Detect duplicate transactions.
Monitor unusual purchasing activity.
Keep validation logic separate from UI and gameplay systems.

A dedicated validation service makes your monetization system easier to maintain and extend.

What's Next?

With receipt validation in place, your purchasing system is significantly more secure.

The next guide focuses on Testing, where you'll learn how to verify purchases using sandbox accounts, internal testing tracks, TestFlight, and other pre-release testing methods.

Related Guides

← Restore Purchases
→ Testing

You can also jump to any section of the guide:

FilesExpand file tree

receipt-validation.md

Latest commit

History