Server-side IAP verification for a client's app surfaced problems the docs don't mention — Apple and Google using three different price scaling factors, a clock-drift bug that looked like a credentials failure, and a webhook reconciliation gap that's still open rather than solved.
Client-side receipts can be spoofed with jailbreak/bypass tooling, and there's no way to block the same purchase token being reused across multiple accounts without a server-side check against your own database first.
Two common causes covered in the post: Apple rejects JWTs if your server's clock is even slightly ahead of theirs (fixed by backdating the iat claim by ~60 seconds), and private keys pulled from environment variables often get mangled (wrong newline characters, legacy key format) in a way that produces a signing failure that looks like a credentials issue.
Not fully — webhooks can be delayed or arrive out of order, and without a polling job or event-ordering check, a late cancellation event can incorrectly overwrite an active subscription. That's flagged in the post as an open gap rather than something already solved.
I'm a freelance NestJS & Node.js backend developer. Let's ship your MVP or SaaS.
Explore other insights in the gallery.