We are currently wrapping up a free-to-play game on iOS in which you can purchase non-consumable products. We have been discussing this case internally and are not quite sure what the best practices are as this is our first title.

For example, if a user downloads our app, and makes some purchases. These can be restored should the app ever be deleted and reinstalled as long as the user uses the same Apple ID. What is to stop him from making a fake Apple account, purchasing items and then posting this account on the web allowing everyone to get the items for free?

That is obviously a worst case situation. But a smaller case would be a user unlocking items for his friends. We do not want this to be an always online game but have considered doing a check on startup if there is internet available. If the currently logged in account doesn't own the products do we lock them again? Probably not because people may simply sign into the device with different Game Center logins at which point we don't want to constantly lock and unlock items.

At some point we will be adding multiplayer at which point we can definately do a check with the currently logged in account. This is because A, they will be online when attempting multiplayer, and B, they will want to use their own account for multiplayer. Unfortunately we aren't quite ready for this yet.

Has anyone tackled this issue. Are we overthinking here?

  • 10
    \$\begingroup\$ Something to keep in mind: Whatever you end up doing, don't screw paying customers, even if it means that pirates get a piece of the cake too. \$\endgroup\$ Commented Aug 30, 2012 at 4:15
  • 1
    \$\begingroup\$ I think you're overthinking. How many people want to switch accounts on their iDevice to play pirated games? And whenever such fake accounts are found, apple is probably willing to use the mighty banhammer. \$\endgroup\$ Commented Dec 14, 2012 at 6:55

1 Answer 1


Firstly, if someone is going to "steal" the purchasable digital items from you, it's going to happen eventually. The only thing you can do it make it difficult for them.

  1. Store the AppleID with the log-in info (or associate it somehow - I don't know anything about Apple StoreKit so I'm assuming they're logging in somehow and you have access to their ID/Username.

  2. Encrypt purchases and keep them locked unless a user who "owns" the purchase is logged in. This would require access to the internet. Some developers outright disable downloadable content if there is no internet connection (i.e. Dragon Age) and others will cache profiles (encrypted, of course) and check to see if purchases belong to that profile.

So, when someone logs in and buys something, the access flag to it gets stored on their profile (which would have to be stored on your database but also cached locally). If someone else logs in, the access to the encrypted content isn't there unless the access flag is on the account. So even if someone downloads all the content, moving it to someone else computer would only allow them to not have to download it but they'd still have to buy it online to access it.

All in all, there is no possible way to nicely prevent someone from sharing an account with all unlocked content (unless you require an internet connection to initially enable the content each time you start the game). But, if you're adding multiplayer, it would be easy to prevent a lot of people from using the same account by only allowing it to log-in once which would hamper online use of the given account.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .