The short answer to basing the restore process on the use of validating the appStoreReceipt is that it will fail in App Review. The issue here stems from the fact that in the sandbox, when the app is installed by Xcode, TestFlight or in App Review, there is never an appStoreReceipt until a purchase is made, or transactions are restored using the restoreCompletedTransactions method. If your app behaves as described, then when the reviewer presses the Restore button, the appStoreReceiptURL will be nil and the app will make use of the SKReceiptRefreshRequest. When the Authentication dialog is presented, the App Reviewer always cancels the request because it requires a password which the reviewer doesn't have. If the reviewer cannot verify that an in-app purchase can be restored, I'm told that the app will be rejected. If the app uses restoreCompletedTransactions, prior transactions will be restored.In the production environment, this is not normally an issue