Receipt validation: identify the path before closing the SHA-256 task
The receipt-certificate change applies differently to on-device validation and newer transaction APIs.
A receipt-validation migration should be closed against the code path used by the game, not against the name of its payment provider. Apple’s certificate notice makes on-device validation a specific branch of the investigation.
Follow a purchase through the system
Ask engineering where validation occurs and which component accepts or rejects a receipt. If several game versions remain in circulation, include the older supported versions in the assessment. A change to the newest build cannot by itself demonstrate what an earlier binary does.
For the acquisition team, the relevant consequence is measurement quality as well as player experience. A broken entitlement path could make a purchase look different in the game, store records and marketing dashboard. That is a diagnostic possibility, not a claim that this certificate change caused any reported revenue decline.
Use a transaction check, not a reassurance
Our suggested acceptance evidence includes a test purchase, an entitlement check and a restore path where applicable. Preserve the environment and build version with the result. Ask which validation mechanism was exercised, because a passing test through a different path does not resolve the original concern.
The artifact separates the dated certificate fact from this proposed verification work. No studio’s payment implementation was inspected for this article. Before changing a ROAS target in response to a sudden purchase anomaly, establish that the events being counted still represent successfully fulfilled transactions.
The governing record is App Store Receipt Signing Intermediate Certificate. This article checks the provider documentation; it does not inspect a studio account or certify a shipped build.
Inspect the evidence
Download the applicability and deadline record. The extraction separates documented facts from our analysis and unknowns.
| Field | Evidence or limit |
|---|---|
| Provider | Apple |
| Effective or release date | 2025-01-24 |
| Applies to | Apps performing on-device App Store receipt validation |
| Documented change | Apple’s SHA-1 receipt-signing intermediate certificate expired on 24 January 2025; on-device validators need SHA-256 support. |
| Suggested owner | Payments engineering |
| Next verification | Identify the validation path and exercise a purchase and restore. |
Further reading in the existing archive: Blended ROAS Calculation: Where It Quietly Goes Wrong; Web shop attribution: measuring D2C without breaking your MMP setup. These links provide background; this check does not independently verify their full contents.
