# iOS affiliate tracking without an SDK: StoreKit 2, appAccountToken, and server notifications

> Attribute iOS subscriptions to affiliates deterministically using only Apple APIs, with no third-party receipt SDK and no device fingerprinting.

Published: 2026-07-20 · Last reviewed: 2026-07-20

## You already have the pieces

Affiliate attribution on iOS is often sold as a heavy client SDK that inspects receipts and guesses at installs. You do not need that. StoreKit 2 and App Store Server Notifications v2 give you a deterministic path using Apple's own APIs, which means less client code, no receipt-parsing library, and no fingerprinting.

The two moving parts are a UUID you set on the purchase and a signed notification Apple sends your server. Everything else is bookkeeping.

## The three steps

First, bind the referral. On first launch your app calls Attribloom, which returns an appAccountToken minted against the referring affiliate. Your app must not generate its own UUID, because a self-invented token attributes to no one. Second, set that token on the StoreKit 2 purchase option. Apple echoes it back, signed, in the transaction. Third, forward each App Store Server Notification v2 to your attribution endpoint, which reads the token, finds the affiliate, and records the conversion at the real transaction value.

- Bind: fetch the Attribloom-issued appAccountToken and persist it.
- Purchase: set the token on the StoreKit 2 purchase, no receipt SDK required.
- Confirm: forward the signed notification server-side for verification and accrual.

## Why this beats an SDK and a fingerprint

A third-party receipt SDK adds a dependency to your binary and still cannot see conversions the way Apple's signed notifications can. Device fingerprinting is worse: since iOS 14.5, using it for attribution violates Apple's App Tracking Transparency rules. The Apple-native path is both compliant and deterministic, because it reads the exact token that rode the purchase.

Attribloom implements the server-side hard part: it re-verifies Apple's JWS chain, matches the token to an affiliate, applies commission on a double-entry ledger, and reverses it on refund. Your app's footprint is a bind call and one purchase option.

## Frequently asked

### Do I need a receipt-validation SDK?

No. StoreKit 2's appAccountToken plus App Store Server Notifications v2 confirm the subscription server-side, so no third-party receipt SDK is required.

### Is this deterministic or probabilistic?

Deterministic. The appAccountToken is a specific UUID carried into the purchase and echoed back by Apple, so attribution is exact rather than an estimate.

### Why can my app not just create its own token?

Because Attribloom ties the token to the affiliate when it mints it. A UUID your app invents is not associated with any affiliate and attributes to nobody.

## Primary sources

- [Apple: appAccountToken](https://developer.apple.com/documentation/appstoreservernotifications/appaccounttoken) · checked 2026-07-20
- [Apple: Product.PurchaseOption appAccountToken(_:)](https://developer.apple.com/documentation/storekit/product/purchaseoption/appaccounttoken(_:)) · checked 2026-07-20
- [Apple: enabling App Store Server Notifications](https://developer.apple.com/documentation/storekit/enabling-app-store-server-notifications) · checked 2026-07-20

## Next steps

- [StoreKit 2 integration guide](/guides/ios)
- [iOS testing guide](/guides/ios-testing)
- [Why iOS affiliate installs are invisible to web tools](/learn/why-ios-affiliate-installs-are-invisible)