Unexpected 401 Unauthorized response from production endpoint when using sandbox transactionId with Get Transaction Info API

Question

Created 1w

Replies 2

Boosts 0

Participants 2

We have encountered an issue when verifying transactions using the Get Transaction Info API. We tested the behavior in both the sandbox and production environments and observed the following results.

When calling the production endpoint: https://api.storekit.itunes.apple.com/inApps/v1/transactions/{transactionId} with a transactionId generated in the sandbox environment, the API returns HTTP 401 Unauthorized. However, based on the documentation and common understanding, we expected HTTP 404 Not Found in this case.

Using the same JWT token, if we call the sandbox endpoint: https://api.storekit-sandbox.itunes.apple.com/inApps/v1/transactions/{transactionId}, we receive HTTP 200 OK with the expected response body.

We have also confirmed that the same behavior occurs when using the Get Transaction History API — it works correctly in the sandbox environment but returns 401 in production.

Could you please confirm whether this behavior (receiving 401 instead of 404) is expected by design, or if it indicates a potential issue? If this is not the intended behavior, we would appreciate any guidance or instructions to resolve it.

Thank you very much for your technical support.

「Get Transaction Info」APIを用いてトランザクションの検証を行ったところ、以下の問題が発生しました。サンドボックス環境および本番環境の両方で検証を行い、次の結果を確認しています。本番環境エンドポイント https://api.storekit.itunes.apple.com/inApps/v1/transactions/{transactionId} に対してサンドボックス環境で生成された transactionId を使用すると、HTTP 401 Unauthorized が返却されます。（一般的には、この場合 404 Not Found が返る想定であると理解しています。）同一のJWTトークンを用いてサンドボックス環境のエンドポイント https://api.storekit-sandbox.itunes.apple.com/inApps/v1/transactions/{transactionId} を呼び出した場合は、HTTP 200 OK が返り、期待通りのレスポンスボディを受け取ることができています。また、同様の挙動が Get Transaction History を使用した場合にも発生することを確認しています。サンドボックス環境では正常に動作しますが、本番環境では401が返却されます。この挙動（401が返却されること）は仕様上想定されたものか、または何らかの問題によるものかご確認をお願いいたします。もし想定外の挙動である場合は、解決に向けたご案内をいただけますと幸いです。本件について、技術的なサポートをお願いいたします。よろしくお願いいたします。

Boost

Answer 1

App Store Commerce Engineer OP

Apple

6d

Until you have a release in production, access to the production APIs is not allowed. Once you have a release in production this will be unlocked.

1

Answer 2

hal-bo OP

6d

@App Store Commerce Engineer

I understand that before release, accessing the production endpoint returns HTTP 401 Unauthorized.

Q1. I would like to confirm: at what point does access to the production App Store Server API become available?

(A) Immediately after App Review approval (when the app status is “Ready for Sale,” but before it is actually published on the App Store), or

(B) After the app is actually released and visible on the App Store?

Also, since purchases during App Review must go through the sandbox environment, I plan to implement a fallback mechanism where, if I receive a 401 from the production API, my server will retry verification using the sandbox API.

Q2. For the pre-release (App Review) phase, is this understanding correct — that I should detect 401 and fallback to sandbox?

Q3. After the app is released and production API access becomes available, if a sandbox transactionId is sent to the production API during a post-release review, is it correct that the response will be 404 Not Found instead of 401?

If so, should I update my fallback logic so that after release, the server falls back to sandbox when 404 is detected (instead of 401)?

To summarize my intended behavior:

Pre-release review: 401 → fallback to sandbox

Post-release review: 404 → fallback to sandbox (if the above assumption is correct)

Could you please confirm (A/B) the exact timing when production API access becomes available, and whether I need to change the fallback condition between pre-release and post-release?

Thank you for your clarification.

0