Attesto

Appearance

AttestoReceipt validation, without the headache.

Drop in. Configure once. Stop thinking about JWS chains, OCSP, and OAuth.

Get integrated
Self-host instead
View on GitHub
Attesto
Apple

Verify Apple in one call

POST a transactionId, get a verified payload. SDK-backed JWS verification with pinned roots, OCSP, and sandbox auto-detection.

Google

Verify Google in one call

Subscriptions and one-shots via the Play Developer API. OAuth + caching handled. Returns the raw response so your backend keeps full fidelity.

📨

Webhooks done right

Apple S2S V2 + Google Pub/Sub RTDN ingested, deduplicated, then forwarded to your callback with HMAC signatures and exponential-backoff retry.

🛡️

Per-tenant isolation

Apple keys, Google service accounts, and webhook secrets encrypted at rest with AES-256-GCM and HKDF-derived per-context subkeys.

See it in action

One HTTP call. Verified payload back. ​

No SDK, no client library. Your backend POSTs a transaction ID, Attesto signs the JWT, calls Apple, verifies the JWS chain, and returns the decoded transaction.

Request
bash
curl -X POST https://api.attesto.nossdev.com/v1/apple/verify \
  -H "Authorization: Bearer attesto_live_…" \
  -H "Content-Type: application/json" \
  -d '{"transactionId":"2000000123456789"}'
Response
json
{
  "valid": true,
  "environment": "production",
  "transaction": {
    "transactionId": "2000000123456789",
    "bundleId": "com.example.app",
    "productId": "premium_monthly",
    "expiresDate": "2026-05-10T14:22:10.000Z",
    "currency": "USD",
    "price": 9990,
    "rawDecodedPayload": { "...": "..." }
  }
}

Google verification has the same shape — different request fields, identical envelope. See the full API reference →

Thin by design

Receipt validation. Nothing else. ​

Attesto answers one question well — "is this transaction real and what does it say?" — and leaves the interpretation to you. If you need entitlements, paywalls, or analytics, look at RevenueCat or iaptic.

Attesto does
  • Verify Apple transactionId with JWS chain + OCSP
  • Verify Google purchaseToken (subscription + product)
  • Receive Apple S2S V2 webhooks (JWS-verified)
  • Receive Google Pub/Sub RTDN (OIDC JWT-verified)
  • Forward HMAC-signed events with retry/backoff
  • Per-tenant credential vault (encrypted at rest)
  • Fail closed on every signature/auth failure
Attesto doesn't
  • Manage entitlements ("is user X premium?")
  • Track subscription state machines
  • Store purchase history as source of truth
  • Analytics, revenue tracking, dashboards
  • Offer codes, promotional logic, trials
  • A/B testing for IAPs
  • Make business decisions on your behalf

This boundary is non-negotiable. Read the full positioning →

Open source

Auditable. Self-hostable. MIT. ​

Every line that touches your .p8 keys and webhook secrets is reviewable today. No closed-source backend, no proprietary magic.

MIT
License — fork it, host it, modify it
232
Tests — unit + integration
100%
Public on GitHub — every line auditable
  • SDK-backed Apple JWS verification with pinned root CAs
  • Google OIDC JWT verification with JWKS caching
  • AES-256-GCM encryption with HKDF-derived per-context subkeys
  • Cryptographic origin verification on every inbound webhook
Browse on GitHub →Changelog
Recommended path

Use the managed service — or self-host. ​

Hosted by Night Owl

Use the managed service ​

Attesto runs at api.attesto.nossdev.com. We operate the credential vault, rotate Apple keys, manage Google service-accounts, and track upstream-API changes. You get an API key and a webhook callback URL — that's it.

Recommended for teams who'd rather ship features than operate validation infra.

Get integrated →

Free, forever

Self-host ​

Clone the repo, configure your encryption key, deploy to Fly / Docker / Kubernetes / your own infra. Full control, zero recurring cost.

Recommended if you have ops capacity and want to control your own data path.

Self-host →

Companion library

@nossdev/iap — Capacitor client SDK ​

Building a Capacitor app? @nossdev/iap is the open-source client SDK that pairs with Attesto. It handles the "client → your backend" leg of the architecture: native purchase + restore, receipt forwarding, and entitlement caching with recovery across app launches.

View iap docs →Source on GitHub

Get in touch

Questions about integrating Attesto? Need help onboarding? Looking for managed hosting so you don't operate it yourself? The NOSS team reads every email.

nossteam@nossdev.com