App Store Server Notification v2 decoder
Paste a signedPayload and read it, including the nested transaction and renewal payloads that Apple signs separately.
Runs in your browser. No network request is made, so pasting a production payload does not send it anywhere. This tool decodes but does not verify Apple's signature. See the questions below for why that has to happen server-side.
Questions
- Does this verify Apple's signature?
- No, and it deliberately says so. This page decodes the JWS so you can read it. Verifying the signature means checking the certificate chain back to Apple Root CA G3 and confirming the chain is not revoked, which has to happen on your server where the result can be trusted. A browser tool telling you a payload is genuine would be security theatre.
- Is my notification uploaded anywhere?
- No. The decoding runs entirely in your browser with atob and JSON.parse. There is no network request, so you can safely paste a production payload.
- Why are there payloads inside the payload?
- App Store Server Notifications v2 nest signed data. The outer JWS carries data.signedTransactionInfo and data.signedRenewalInfo, each its own JWS. This tool decodes all three so you do not have to do it three times by hand.
- Where is appAccountToken?
- Inside the decoded transaction info, not the outer payload. That UUID is what links an App Store purchase back to the affiliate who drove it, which is the whole basis of StoreKit 2 affiliate attribution.
Attributing these notifications
Attribloom verifies the signature server-side against Apple's chain, then uses the appAccountToken to credit the affiliate who drove the purchase. Read how the attribution works, or work out the commission split.