iOS SDK

The Swift SDK is a Swift Package with zero dependencies. It enrolls each install with App Attest, attributes every verified StoreKit 2 transaction automatically, and serves server-driven paywall SKUs.

RequirementsCopy Anchor Link

• iOS 15+, macOS 12+, tvOS 15+ or watchOS 8+ (the package manifest platforms).
• Swift tools 5.9.
• The app must already exist in App Store Connect under the key you connected to RevenueHog. The server maps your bundle ID to your workspace through that data. See App Store Connect.
• The App Attest capability on the app target.

InstallCopy Anchor Link

https://github.com/Parra-Inc/revenue-hog-sdks

.package(url: "https://github.com/Parra-Inc/revenue-hog-sdks", from: "0.2.0")
// target dependency:
.product(name: "RevenueHog", package: "revenue-hog-sdks")

import RevenueHog

@main
struct MyApp: App {
    init() {
        RevenueHog.configure()
    }
    var body: some Scene { WindowGroup { ContentView() } }
}

// after login
RevenueHog.identify(userId: "user_42")

// on logout
RevenueHog.reset()

How auth worksCopy Anchor Link

There is no API key. On first launch the SDK:

1. Requests a single-use challenge from POST /api/sdk/v1/attest/challenge.
2. Generates an App Attest key and asks Apple to attest it against the challenge.
3. Sends the attestation to POST /api/sdk/v1/attest. RevenueHog verifies it, checks that the attested <teamId>.<bundleId> matches an app it already knows from your App Store Connect data, and returns an opaque device token (dt_…).

The token is stored in the Keychain and sent as Authorization: Bearer dt_… on every request after that. It is scoped to one workspace, app and device, is worthless for reading data, and appears under Settings > SDK DEVICES, where you can revoke it.

Details of the enrollment state machine, from the code:

Unattested requests carry an X-RevenueHog-Unattested header with the reason (pending, unsupported, simulator or enroll-failed). They are accepted on the quarantine path and labeled unverified. Attribution calls also carry the StoreKit 2 signed transaction (jws), which the server verifies independently, so the purchase link is trusted even from an unattested session.

Entitlement self-checkCopy Anchor Link

At configure() on a physical device, the SDK checks its own binary for the App Attest entitlement. If it is missing, DEBUG builds hit an assertion (RevenueHog: App Attest entitlement missing. Add the App Attest capability to the app target.) and release builds log the error once and run unattested.

To turn a later deletion of the entitlement into a build error, add a Run Script build phase to app targets that link the SDK:

if ! grep -q "com.apple.developer.devicecheck.appattest-environment" "${CODE_SIGN_ENTITLEMENTS:-/dev/null}"; then
  echo "error: RevenueHog: App Attest entitlement missing. Add the App Attest capability to the app target."
  exit 1
fi

With ENABLE_USER_SCRIPT_SANDBOXING = YES, declare $(SRCROOT)/$(CODE_SIGN_ENTITLEMENTS) as an input file of the phase, otherwise the sandbox blocks grep and the guard fails on a correct project.

Automatic attributionCopy Anchor Link

When enableAutoAttribution is true (the default), the SDK starts a background task that reads Transaction.currentEntitlements once, then listens to Transaction.updates. For each verified transaction it calls /api/sdk/v1/attribute with:

• originalTransactionId: String(transaction.originalID)
• productId: transaction.productID
• jws: result.jwsRepresentation

Unverified transactions are skipped. A transaction already reported for the current user is not re-sent.

API referenceCopy Anchor Link

RevenueHog.configure(options:)Copy Anchor Link

public static func configure(options: Options = Options())

Sets up the SDK, starts enrollment, replays any queued requests, resolves the StoreKit environment in the background, and starts the transaction listener unless enableAutoAttribution is false. Safe to call again (it reconfigures and restarts the listener). If you never call it, every other method is a logged no-op.

RevenueHog.identify(userId:)Copy Anchor Link

public static func identify(userId: String)

Stores userId as the current user, sends /api/sdk/v1/identify with device context, then re-sends every transaction previously reported under a different ID so it moves to this user. An empty or whitespace-only ID is ignored with a warning. Changing the user clears the paywall cache.

RevenueHog.setAttributes(_:)Copy Anchor Link

public static func setAttributes(_ attributes: [String: String])

Sends an identify call carrying attributes. The server shallow-merges them into what is stored. The serialized object must be at most 8 KB.

RevenueHog.attributePurchase(originalTransactionId:productId:)Copy Anchor Link

public static func attributePurchase(originalTransactionId: String, productId: String? = nil)

Manual attribution, needed only when enableAutoAttribution is false or purchases happen outside StoreKit 2. Pass the original transaction ID, not a renewal's transaction ID. Manual calls carry no JWS.

RevenueHog.reset()Copy Anchor Link

public static func reset()

Forgets the user on logout: clears the user ID, the sent-transactions record, the paywall cache and the offline queue, and issues a fresh anonymous ID. Device enrollment and the install ID survive.

RevenueHog.paywall(for:fallback:forceVariant:)Copy Anchor Link

public static func paywall(
    for entitlement: String,
    fallback: [String],
    forceVariant: String? = nil
) async -> Paywall

Returns the ordered SKU list for an entitlement. Never throws. Resolution order: fresh cache, a network fetch with a 2.5 second deadline (no enrollment wait), stale cache, then fallback. See Paywall.

RevenueHog.paywallShown(_:rendered:)Copy Anchor Link

public static func paywallShown(_ paywall: Paywall, rendered: [String])

Reports that the paywall appeared, with the product IDs that actually rendered (at most 50 are sent). No-op when paywall.experimentId is nil. Sent with up to 2 attempts and never queued.

OptionsCopy Anchor Link

RevenueHog.configure(options: Options(
    baseURL: URL(string: "https://hog.internal.example")!,
    enableAutoAttribution: true,
    logLevel: .debug
))

Paywall and PaywallSkuCopy Anchor Link

paywall.products() (iOS 15+) loads the products through StoreKit and returns them sorted to menu order. Product.products(for:) returns products unordered, so never render its order directly.

What is stored on the deviceCopy Anchor Link

The install ID survives reinstalls because it lives in the Keychain.

What is sentCopy Anchor Link

Your user ID (or the anonymous ID), bundle ID, platform: "ios", OS version, device model, locale, attributes you pass, and the Apple-signed transaction for purchases. On paywall fetches, the install ID and StoreKit's AppTransaction.environment (iOS 16+; omitted until resolved).

Behavior notesCopy Anchor Link

• Requests that fail with a network error, 429 or 5xx retry up to 3 times with exponential backoff (0.5 s, then 1 s), then queue. Any other non-2xx response is logged and dropped, never retried.
• A queued request is replayed on the next launch or after the next successful call.
• Attribution works in the sandbox too.

TroubleshootingCopy Anchor Link

codesign -d --entitlements - MyApp.app | grep -A2 appattest

RelatedCopy Anchor Link