RevenueCat
RevenueCat handles native in-app purchases and subscriptions for you - the kind users buy through the App Store and Google Play, not card payments. It manages the paywall, the entitlement that unlocks paid features, and the cross-platform receipt checks that Apple and Google would otherwise make painful. This is distinct from Stripe card payments: use RevenueCat for app-store subscriptions and one-off purchases, Stripe for cards on the web.
What you get by connecting it
Once RevenueCat is connected, the agent can build:
- A paywall screen that shows your offerings and prices.
- The purchase flow, using the correct platform key on each device (iOS or Android).
- Entitlement checks that gate paid features, so the right content unlocks the moment a purchase clears.
- A restore-purchases flow, which Apple requires for any app selling subscriptions.
In preview, the agent uses deterministic local sample products and disables purchase/restore actions. Real offerings and purchases require the RevenueCat native SDK in a development build, plus products, entitlements, a current Offering, and store credentials configured in RevenueCat.
Connecting it
RevenueCat gives you a separate public key for each platform:
- A Test Store key that starts with
test_, for RevenueCat Test Store development only. - An iOS public key that starts with
appl_. - An Android public key that starts with
goog_. - Optionally, a secret REST API v2 key for a read-only live connection check. Appsanic does not transfer it to a generated backend.
Find them in the RevenueCat dashboard under Project settings then API keys. Open the Appsanic project build, select Connectors, choose RevenueCat, and enter them. The connection applies only to that project and requires a paid plan.
Saved secret fields show as dots - browser JavaScript sees only that a key exists. Test now uses a non-mutating API v2 project-list read when a secret key is present; with SDK keys alone it checks their format. It never calls RevenueCat's get-or-create customer endpoint. Use Disconnect to remove the connection from the project.
A test_ key is not a substitute for appl_ or goog_ in a real App Store or Play Store release. Export the project, install react-native-purchases, and test in a development build; the SDK cannot run in the browser preview or Expo Go.
Keys and security
RevenueCat SDK keys (test_, appl_, and goog_) are public by design. The generated setup chooses the appropriate key, but it remains commented until native setup. Use test_ only with Test Store; use the correct platform key for release. Configure the SDK with a stable, unguessable authenticated user ID such as an auth UUID - never email, phone number, or a sequential identifier.
The optional secret REST key is different: like any secret, it must never be bundled into an app people download. Appsanic uses it only for the connection check. If your app needs server-side subscriber reads, deploy a narrow relay and add a separate least-privilege REST key directly to that backend's secret manager. Connecting RevenueCat does not copy the saved key into the relay.
A RevenueCat REST API key does not verify webhook deliveries. Configure a dedicated Authorization value or enable HMAC signing on the webhook, then put that separate secret directly in the receiving backend. Verify the signature over the raw request body before parsing, apply a short timestamp tolerance, and deduplicate events by their event ID.
Platform SDK keys are approved public connector metadata. An optional secret REST key is encrypted at rest with AES-256-GCM and represented only by a presence flag outside trusted server code. The agent will never ask for a secret key in chat.
Useful links
- RevenueCat docs: https://www.revenuecat.com/docs
- Appsanic guide: Payments
Next
Read Payments for the full picture of charging money in your app, including when to reach for RevenueCat versus Stripe.