Check this: https://gist.github.com/behe/25ddd9e873f36657776f69e6d4ea8ade And this: https://stackoverflow.com/questions/69735525/how-to-verify-jws-transaction-of-app-store-server-api-in-go Basically you can validate it with apples root certificate.