Verifying an iOS App's Authenticity With Apple's Lookup API (OKX as a Case Study)

When a user says "the app disappeared from my App Store", most guides answer with a region table. You can do better: Apple's public iTunes lookup endpoint answers the question directly, and it also gives you the fields needed to prove an app is the real one.

Here's the method, using the OKX exchange app as the worked example.

The endpoint

https://itunes.apple.com/lookup?id=<trackId>&country=<cc>
https://itunes.apple.com/search?term=okx&country=<cc>

Both are unauthenticated. The lookup response includes trackName, sellerName, bundleId, version, fileSizeBytes, minimumOsVersion, and currentVersionReleaseDate.

What the response tells you

Querying the exchange app (track id 1327268470) in November 2026:

Querying the wallet app (track id 6743309484) returns OKX Technology Inc. and bundleId com.okx.wallet — a different product from a different legal entity. If a page describes them as one app, the page is wrong.

Testing region availability properly

The naive test is: query with country=cn, get zero results, conclude "not available in China". That's not sound — the endpoint could be failing for the whole storefront.

Query by track id, not by keyword, and run a control in the same storefront:

lookup?id=1327268470&country=cn   → 0 results
lookup?id=1327268470&country=hk   → 1 result
search?term=wechat&country=cn     → 3 results   (control: storefront works)

The control returning results proves the CN storefront is functional, so the zero for the target app is a real absence rather than an API quirk.

There's a second trap: keyword search in a storefront matches app names loosely. search?term=okx&country=cn currently returns 1 result — an unrelated app whose listing merely contains the term, not the exchange. If you'd used keyword search as your test, you'd have concluded the opposite of the truth. Look up by id; use keywords only to discover an id.

What this method can't tell you

• It won't tell you whether the app is safe, only whether it is that app.
• version and fileSizeBytes change with every release — they detect a stale clone, not a forgery that updates in step.
• The stable anchors are sellerName and bundleId. Prefer those in any check you automate.

If you're building a download-instruction page or an app-verification tool, the practical rule is: pin the two stable fields, date-stamp the volatile ones, and always show the raw byte count rather than a rounded "850 MB", so a reader can diff it against the store page themselves.

👉 Full iPhone installation walkthrough for the OKX app, including the three install routes and the four-field check — CoinVado records the query date next to every number.