All articles

App Store attribution

iOS affiliate tracking without an SDK: StoreKit 2, appAccountToken, and server notifications

Attribute iOS subscriptions to affiliates deterministically using only Apple APIs, with no third-party receipt SDK and no device fingerprinting.

Published · Last reviewed

Written by Attribloom Engineering · Reviewed by Attribloom Product · Last reviewed

You already have the pieces

Affiliate attribution on iOS is often sold as a heavy client SDK that inspects receipts and guesses at installs. You do not need that. StoreKit 2 and App Store Server Notifications v2 give you a deterministic path using Apple's own APIs, which means less client code, no receipt-parsing library, and no fingerprinting.

The two moving parts are a UUID you set on the purchase and a signed notification Apple sends your server. Everything else is bookkeeping.

The three steps

First, bind the referral. On first launch your app calls Attribloom, which returns an appAccountToken minted against the referring affiliate. Your app must not generate its own UUID, because a self-invented token attributes to no one. Second, set that token on the StoreKit 2 purchase option. Apple echoes it back, signed, in the transaction. Third, forward each App Store Server Notification v2 to your attribution endpoint, which reads the token, finds the affiliate, and records the conversion at the real transaction value.

  • Bind: fetch the Attribloom-issued appAccountToken and persist it.
  • Purchase: set the token on the StoreKit 2 purchase, no receipt SDK required.
  • Confirm: forward the signed notification server-side for verification and accrual.

Why this beats an SDK and a fingerprint

A third-party receipt SDK adds a dependency to your binary and still cannot see conversions the way Apple's signed notifications can. Device fingerprinting is worse: since iOS 14.5, using it for attribution violates Apple's App Tracking Transparency rules. The Apple-native path is both compliant and deterministic, because it reads the exact token that rode the purchase.

Attribloom implements the server-side hard part: it re-verifies Apple's JWS chain, matches the token to an affiliate, applies commission on a double-entry ledger, and reverses it on refund. Your app's footprint is a bind call and one purchase option.

Sources and verification

Primary documentation last checked on 2026-07-20. Each source below links the exact page and its own last-checked date.

Next steps

Frequently asked

Do I need a receipt-validation SDK?

No. StoreKit 2's appAccountToken plus App Store Server Notifications v2 confirm the subscription server-side, so no third-party receipt SDK is required.

Is this deterministic or probabilistic?

Deterministic. The appAccountToken is a specific UUID carried into the purchase and echoed back by Apple, so attribution is exact rather than an estimate.

Why can my app not just create its own token?

Because Attribloom ties the token to the affiliate when it mints it. A UUID your app invents is not associated with any affiliate and attributes to nobody.

In the glossary

Continue reading

Get startedSee pricingMore articles