Store credentials

To validate real purchases server-side, EntitleHub needs to talk to the stores. Apple works out of the box; Google Play needs a service account.

Apple (StoreKit 2): nothing to configure

Apple StoreKit 2 transactions are signed JWS blobs. Send the signed_transaction to /v1/subscribers/{id}/purchases and EntitleHub verifies it against Apple's root CA, checking the certificate chain and signature, with no per-project secret. The authenticated product id and environment from the receipt override anything the client claims, so a purchase can't be forged.

Apple server-to-server notifications (renewals, cancels, refunds)

So a subscription's renewals / cancellations / refunds stay current server-side without the app re-reporting, point Apple's notifications at EntitleHub. In App Store Connect → your app → App Information → App Store Server Notifications, set the Production (and Sandbox) Version 2 URL to:

https://entitlehub.com/v1/notifications/apple/{YOUR_PROJECT_ID}

EntitleHub verifies each notification's signature against Apple's root CA and updates the matching grant. Your Project ID is in Settings → General.

Google Play: add a service account

Google purchase tokens are validated by calling the Play Developer API, which needs a service account with access to your Play account.

1. In Google Cloud Console, create a service account and a JSON key for it (IAM & Admin → Service Accounts → Keys → Add key → JSON).
2. Enable the Google Play Android Developer API for that Cloud project.
3. In Play Console → Users & permissions, invite the service account's email and grant it access to view financial data and manage orders / subscriptions for your app.
4. In EntitleHub → Dashboard → Settings → Store credentials, paste the JSON key and your app's package name (e.g. com.yourco.app).

Reporting a validated Google purchase

Once the credential is in place, pass the purchase token; EntitleHub validates it and uses the store's authenticated expiry:

curl https://entitlehub.com/v1/subscribers/USER_ID/purchases \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{
    "store": "play",
    "store_product_id": "app_pro_monthly",
    "purchase_token": "PLAY_PURCHASE_TOKEN",
    "is_subscription": true
  }'

Google Real-Time Developer Notifications (RTDN)

For automatic renewal / expiry / refund tracking, wire up RTDN:

1. In Google Cloud → Pub/Sub, create a topic (e.g. play-rtdn).
2. Add a push subscription on that topic with the endpoint:
   textcopy

   https://entitlehub.com/v1/notifications/google/{YOUR_PROJECT_ID}

3. Grant Google Play's publisher service account permission to publish to the topic (add [email protected] as a Pub/Sub Publisher).
4. In Play Console → Monetization setup → Real-time developer notifications, set the topic name to your play-rtdn topic.

On each notification EntitleHub re-validates the purchase token against your Play credential (the source of truth for expiry) and updates the grant, then fires your webhooks. Requires the Google Play credential above.

Stripe: add your secret key

For web subscriptions billed through Stripe, add your Stripe secret key in Dashboard → Settings → Store credentials → Stripe (from Stripe → Developers → API keys). EntitleHub verifies the key against Stripe when you save it, and stores it encrypted.

Map your Stripe Price as an EntitleHub product: create a product with store stripe and store_product_id set to the Stripe Price id (e.g. price_1P…), mapped to an entitlement. Then report a subscription by id, EntitleHub confirms it's active/trialing and uses the current period end as the entitlement expiry:

curl https://entitlehub.com/v1/subscribers/USER_ID/purchases \
  -H "Authorization: Bearer sk_live_…" \
  -H "Content-Type: application/json" \
  -d '{ "store": "stripe", "stripe_subscription_id": "sub_1P…" }'

Stripe webhooks (renewals, cancels, refunds)

So EntitleHub keeps subscriptions in sync after the first purchase, add a Stripe webhook endpoint. In Stripe → Developers → Webhooks, point a new endpoint at:

https://entitlehub.com/v1/notifications/stripe/YOUR_PROJECT_ID

Subscribe to customer.subscription.updated, customer.subscription.deleted, invoice.payment_succeeded, invoice.payment_failed, and charge.refunded. Copy the endpoint's signing secret (whsec_…) into Settings → Store credentials → Stripe. EntitleHub verifies every delivery's signature, re-validates the subscription against Stripe for the authoritative period end, updates the grant, and fans the change out to your own webhooks.

Credentials set. Time to integrate: SDK or REST API.