Hi StoreKit team,
I posted a question in the App Attest forum yesterday that is related to StoreKit [1]. The engineers there recommended I post here.
I'd like to use StoreKit 2's appTransactionID [2] as an ID to tie App Attest keys to anonymous users (that is, users that I don't enforce signup/login of).
The design I'm thinking of is basically:
- Get the appTransactionID at launch
- Look in keychain to see if I already have an attestation key for this appTransactionID (treating keychain as a k/v store where the key is appTransactionID)
- If yes, use that key for ongoing assertions as requests are made to my backend
- Else, go through the initial process of key generation and attestation
Do you see any gotchas with using appTransactionID in this way? From the docs, it looks to be exactly what I need:
The App Store generates a single, globally unique appTransactionID for each Apple Account that downloads your app and for each family group member for apps that support Family Sharing.
This value remains the same for the same Apple Account and app if the customer redownloads the app on any device, receives a refund, repurchases the app, or changes the storefront. For apps that support Family Sharing, the appTransactionID is unique for each family group member.
But I'm curious if this application of using appTransactionID as the key identifier to pull values out of keychain raises any flags for you.
Thank you,
Lou
[1] https://developer.apple.com/forums/thread/831468
[2] https://developer.apple.com/documentation/storekit/apptransaction/apptransactionid
I am not able to speak to the usage of App Attest, so I don't know if this is a good usage, compared to creating a new random UUID or something else.
I can give you some information on appTransactionID that may help, however. In general, this will get you a unique ID for every user that has downloaded your app from the App Store. But there are a few cases to consider:
- Users may change accounts in some cases, which will result in a different appTransactionID: https://support.apple.com/en-us/117294
- If your app has been assigned to a device, rather than an account, the appTransactionID will be an empty string. So if you intend to use it for this, you should make sure to check that the string isn't empty before creating an App Attest key. For more info on device assignment, see: https://support.apple.com/guide/apple-configurator-mac/assign-apps-to-devices-cadbf9c811/mac
