CommerceGateApple

Server-side Swift 6.1+ guard for Apple Advanced Commerce requests on Linux and macOS. It evaluates an unsigned request through CommerceGate and invokes the developer-owned Apple JWS signer only after an ALLOW decision.

Install

dependencies: [
    .package(
        url: "https://github.com/decionis/commercegate-apple-swift.git",
        from: "1.0.0"
    )
]

The customer keeps the App Store Connect private key, issuer ID, and key ID in its own secret manager. CommerceGate never receives Apple private signing material.

Minimal integration

import CommerceGateApple

let transport = try HttpCommerceGateTransport(
    endpoint: URL(string: "https://commerce.decionis.com")!,
    apiKey: ProcessInfo.processInfo.environment["DECIONIS_API_KEY"]!
)
let guardClient = AppleCommerceGuard(
    client: CommerceGateClient(transport: transport)
)

let authorized = try await guardClient.authorizeAndSign(intent, using: appleSigner)
// Send authorized.signedJws to the app only after this call succeeds.

appleSigner implements AppleJwsSigningProvider and should delegate signing to Apple's official App Store Server Swift Library.

The client also verifies the response UUID and canonical request SHA-256 before invoking the signer. Transport failures and malformed or mismatched responses fail closed at this boundary.

Outcomes

Outcome	Signing behavior
ALLOW	Invokes the injected Apple signer once. Inspect costBasisStatus if the customer policy requires trusted cost.
BLOCK	Does not invoke the signer.
REVIEW_REQUIRED	Does not invoke the signer.
Transport or binding error	Does not invoke the signer.

Support and license

Support: decionis.com

License: See the repository license.