Subscriptions not verifying nor binding

[timolino13]

After purchasing a subscription I verify the purchase with IAPKit, and on success i try to bind the user to the subscription.
The problem is that, even though verification is successfull, on the dashboard the purchase status is still Pending Aknowledgment, and the bind does not work.

Code

onPurchaseSuccess: async (purchase: Purchase) => {
            try {
                const purchaseToken = purchase.purchaseToken;
                console.log("Purchase token:", purchaseToken);
                if (!purchaseToken) {
                    throw new Error("Purchase token is missing");
                }

                const result = await verifyPurchaseWithProvider({
                    provider: "iapkit",
                    iapkit: {
                        apiKey: process.env.EXPO_PUBLIC_IAPKIT_API_KEY,
                        ...(Platform.OS === "ios"
                            ? { apple: { jws: purchaseToken } }
                            : { google: { purchaseToken: purchaseToken } }),
                    },
                });

                console.log("Verification result:", result);

                if (result.iapkit?.isValid) {
                    const r = await kitApi({ apiKey: process.env.EXPO_PUBLIC_IAPKIT_API_KEY || "" }).bindUser(purchaseToken, userId);
                    console.log("Bind result:", r);

                    await finishTransaction({ purchase });

                    await getActiveSubscriptions();
                }
            } catch (error) {
               ...
            } finally {
                ...
            }
        },

Logs

Verification result: {"__typename": "VerifyPurchaseWithProviderResult", "errors": null, "iapkit": {"__typename": "RequestVerifyPurchaseWithIapkitResult", "isValid": true, "state": "pending-acknowledgment", "store": "google"}, "provider": "iapkit"}
Bind result: {"bound": false, "ok": true}

[gitdogbot]

@timolino13 Correction after your follow-up: my earlier diagnosis was incomplete.

finishTransaction before bindUser is still a good Android ordering check because Expo IAP acknowledges non-consumables/subscriptions with acknowledgePurchaseAndroid(token). But bound: false is not caused by bindUser checking pending-acknowledgment and refusing the bind.

In the current OpenIAP/IAPKit code, bindUser does this:

• /v1/subscriptions/bind-user/:apiKey normalizes the token and calls the subscription bind mutation.
• The bind mutation looks up subscriptions by (projectId, purchaseToken).
• If no subscription row exists for that project/token, it returns { ok: true, bound: false }.

So your follow-up result (state: "entitled" but bound: false) means the original ordering-only answer does not explain the issue. The next things to check are:

1. Verify and bind are using the same IAPKit project/API key.
2. Confirm the IAPKit subscription row exists for that Google purchaseToken. If no matching row exists, binding cannot find a target row.
3. Check whether Google RTDN/webhook ingestion is configured and receiving the subscription event for this project. The subscription table is driven by subscription events; verification persists purchase verification state, but the bind path currently looks in subscriptions.
4. If a subscription row exists under a different token, this may be a Google token/order transition case and the bind path may need a fallback or reconciliation fix.

A safer test flow is: verifyPurchaseWithProvider -> finishTransaction -> verify again until the state is entitled -> bindUser, while also checking whether the subscription row has appeared. If it remains { ok: true, bound: false } with an entitled verification result, this looks like an IAPKit bind/subscription-row mismatch rather than an acknowledge-order problem.

---

🤖 Generated by gitdog.hyo.dev · Have more questions? Tag @gitdog and let me know!

[timolino13]

We tried moving the finilization before the bind call, but still get the same result.

We also tried moving the finalization before the verification, and the only difference is that the status goes to entitled.

Verification result: {"__typename": "VerifyPurchaseWithProviderResult", "errors": null, "iapkit": {"__typename": "RequestVerifyPurchaseWithIapkitResult", "isValid": true, "state": "entitled", "store": "google"}, "provider": "iapkit"}
Bind result: {"bound": false, "ok": true}

[timolino13]

@GitDog Thanks for the update.
I noticed the subscription is not appearing in the subscriptions row. I've tried to set up the Google RTDN according to the docs, but it's still not working. The test notification in the Monetization Setup works.
One thing i noticed is that the pubsub.publisher does not exist, or at least i can't find it. I now gave the pubsub.admin role.
Also i don't really understand which url i'm supposed to put where while setting up the subscription. The docs say Endpoint URL = the kit URL, is this the webhook url or the base https://kit.openiap.dev/v1 url? And what should go in the Audience?

[gitdogbot]

@timolino13

Correction: my previous reply was inaccurate. IAPKit is hosted at kit.openiap.dev, but the relevant kit code and RTDN/webhook docs are in this OpenIAP monorepo under packages/kit and packages/docs.

For the Google RTDN setup, use the lifecycle webhook URL from the kit dashboard's Webhooks tab:

• Preferred endpoint URL: https://kit.openiap.dev/v1/webhooks/{apiKey}
• /v1/webhooks/google/{apiKey} is also supported as a Google-specific alias, but the {apiKey} path segment is required.
• Do not use the base https://kit.openiap.dev/v1 URL.
• Do not use https://kit.openiap.dev/v1/webhooks/google without the API key.

For the Pub/Sub push subscription:

1. Delivery type: Push
2. Endpoint URL: the full kit webhook URL above
3. Authentication: enable OIDC with your push service account and the Token Creator setup described in the docs.
4. Audience: the kit deployment origin, normally https://kit.openiap.dev for hosted kit. It is not your Google Cloud project ID.

For the Google Play -> Pub/Sub topic permission:

• Grant roles/pubsub.publisher to google-play-developer-notifications@system.gserviceaccount.com on the topic.
• In the Cloud Console UI this may appear as Pub/Sub Publisher rather than the raw role id.
• pubsub.admin is broader than needed; it can unblock testing, but it is not the least-privilege production role.

Why the Play Console test notification can work while no subscription row appears:

• The RTDN test notification only proves that Play can publish a test event through Pub/Sub.
• It does not include a real subscription purchase token, so it should not be expected to create a subscription row.
• A real subscriptionNotification from a purchase/renewal must reach POST /v1/webhooks/{apiKey} and pass the API-key and OIDC checks before kit can update the subscription table.

So the next concrete checks are: copy the exact webhook URL from the kit Webhooks tab, use that full URL as the Pub/Sub push endpoint, set Audience to https://kit.openiap.dev, then trigger a real subscription purchase/renewal and check the kit Webhooks/logs. If it still does not create a row, a 401 usually points to OIDC audience/principal configuration, a 503 points to the kit Pub/Sub audience configuration, and no event at all points back to Play Console topic/subscription wiring.

---

🤖 Generated by gitdog.hyo.dev · Have more questions? Tag @gitdog and let me know!

[timolino13]

I managed to set up the webhook. The subscription appeared one the dashboard and managed to bind successfully.
When i then cancelled the subscription from the store, it didn't update the dashboard correctly.
When i call GET /v1/subscriptions/status/:apiKey?userId= i get

{
  "active": false,
  "subscription": {
    "cancellationReason": "UserCanceled",
    "currency": "CHF",
    "expiresAt": 1783426528260,
    "id": "...",
    "platform": "Android",
    "priceAmountMicros": 4900000,
    "productId": "premium_monthly",
    "purchaseToken": "...",
    "renewsAt": 1783426528260,
    "startedAt": 1783426230434,
    "state": "Active",
    "updatedAt": 1783426431059,
    "userId": "...",
    "willRenew": false
  }
}

The expiration time has already passed. The top property says "active": false, but then the subscription object says "state": "Active".
Also GET /v1/subscriptions/entitlements/:apiKey?userId= gives me no products and no subscriptions.
So now we're stuck in a state where IAPKit says the subscription is still active, while the Play Store says we do not have a subscription.

And on top of all this, the purchase is still pending acknowledgment.

All of this worked 1.5 months ago. Did you change something on your end? Because we haven't touched the code or the configs since then.

[hyochan]

Root cause confirmed: Google subscription verification persisted the receipt into purchases, but bindUser looks up subscriptions by (projectId, purchaseToken). Before any RTDN/webhook arrived, there was no canonical subscription row to bind, so bindUser returned { ok: true, bound: false } even though IAPKit verification returned isValid: true.

Fix is up in #210.

The fix bootstraps subscription rows directly from Apple/Google receipt verification, keeps webhook-enriched fields intact on later verifies, treats Google pending-acknowledgment subscriptions as valid active subscriptions while acknowledgement is still required, and keeps repeated verification idempotent for subscription stats.

[hyochan]

The fix from #210 has been merged into main and deployed to kit.openiap.dev.

Deployment details:

• Merge commit: 69abbd3
• Kit deploy workflow: Kit - Verify + Deploy completed successfully
• https://kit.openiap.dev/health returns OK

Could you please retry the original subscription verify + bind flow against the hosted IAPKit service? For the cleanest check, please use a new sandbox subscription purchase or re-run verification before binding so the canonical subscription row can be bootstrapped from the latest receipt verification path.

If you still see a mismatch after retrying, please share the latest verifyPurchaseWithProvider, bindUser, and /v1/subscriptions/status responses with receipt tokens/API keys redacted.

[timolino13]

Thanks for the quick fix!
I tested it and it is working now. It correctly created the subscription, bound the user, and changed to expired after expiration.
The only problem I'm still having is that the purchase doesn't change to Entitled. Maybe i got it wrong, but as far as i understand, it should change to Entitled after having finalized the order, which we did.

And in general, all the purchases don't update when they expire, unless i verify them again. Is this intended? Because currently i have about 30 purchases that say they are valid, but as soon as i verify them again they are expired