App Store
appAccountToken best practices
appAccountToken best practices govern how an app sources and sets the StoreKit 2 token: use the Attribloom-issued UUID, never invent your own, and reuse the same token across an account's purchases.
Published · Last reviewed
Written by Attribloom Engineering · Reviewed by Attribloom Product · Last reviewed
The appAccountToken is a UUID your app sets on a StoreKit 2 purchase, which Apple echoes back in the signed transaction and in every App Store Server Notification. It is the deterministic key that ties a purchase to an affiliate.
The core rule for attribution is token ownership: an app must not invent its own token. Attribloom ties the token to the affiliate when it mints it, so a UUID your app generates is associated with no affiliate and attributes to nobody. Always fetch the token from the bind endpoint, persist it, and set that same value on the account's purchases so renewals and later purchases resolve to the same referral.
Frequently asked
Can my app generate its own appAccountToken?
Not for attribution. Attribloom binds the token to an affiliate at mint time, so a token your app invents attributes to no one. Fetch it from the bind endpoint instead.
When should the token be bound?
On first launch of a referred install, before the purchase. Persist the returned UUID and set it on the StoreKit 2 purchase so Apple returns it in the signed transaction.