JWS (JSON Web Signature)

A signed token format: three base64url segments (header, payload, signature). Apple signs every Server Notification as a JWS with a certificate chain (x5c) ending at Apple's root CA, so a receiver can prove the event really came from Apple before trusting a cent of it.

The header declares alg: ES256 and carries x5c, an array of base64 DER certificates ordered leaf, intermediate, root. Verification means all of: the signature checks out against the leaf's public key, the leaf chains to the intermediate and the intermediate to the root, every certificate is inside its validity window, and the root is byte-identical to the Apple Root CA you downloaded from Apple yourself.

Skipping that last step is the failure that looks like success. A chain that verifies only against itself proves nothing: anyone can generate one. So does letting the header choose the algorithm rather than pinning ES256.

Apple nests JWS inside JWS. signedTransactionInfo and signedRenewalInfo are themselves signed tokens carried inside the signed outer payload.

See: Verifying the JWS, step by step →