If a user can replace these, they can defeat your receipt validation checks, so it is important to make it difficult for a user to easily find and modify these keys. For your application, this is an encrypted Google Play public key, and/or Apple’s root certificate. Receipt validation is performed using known encryption keys. Unity IAP provides tools to help you hide content and to validate and parse receipts through Google Play and Apple stores.

If the content that the user is purchasing already exists on the device, the application simply needs to make a decision about whether to unlock it. For more information, please see Apple and Android’s documentation on fraud prevention. Validating sensitive transactions server-side where possible is considered best practice. Important: While Unity IAP provides a local validation method, local validation is more vulnerable to fraud. Unity does not offer support for server-side validation however, third-party solutions are available, such as Nobuyori Takahashi’s IAP project.

Remote validation: For server-side content, where content is downloaded once purchased, the validation should take place on the server before the content is released.

See Local validation below for more information.

Unity IAP is designed to support local validation within your application. Local validation: For client-side content, where all content is contained in the application and is enabled once purchased, the validation should take place on the target device, without the need to connect to a remote server.It is best practice to validate the receipt at the point where your application’s content is distributed. Receipt validation helps you prevent users from accessing content they have not purchased.

Receipt validation apple sandbox