Start with identity

If your product has accounts, the cleanest recovery path is a stable appUserId on every install and every device. That reduces your need to rely on restore flows as the primary identity mechanism.

Use the right recovery API

  • Use restore when the customer explicitly asks to recover purchases.
  • Use quiet sync when you need a silent reconciliation step.
  • Use receipt queue drain when you intentionally need to flush retryable receipt work and refresh state.

User-facing restore button

Do not call restore automatically on every startup. Put it behind an explicit user action such as a settings-screen “Restore purchases” button.

Scenario matrix

Reinstall behavior

Anonymous users can end up with a new local identity after reinstall. If your product needs stronger continuity, prefer:
  1. sign the user into your app account
  2. configure AppActor with the same stable appUserId
  3. run the appropriate recovery flow only if customer state still needs reconciliation

Consumables and credits

For consumables, tokens, and backend-granted credits, wait for backend receipt acceptance rather than assuming every local purchase callback represents a final server-side grant.