How to guarantee that user won't be able to makeup transaction_id to call new api

If my user purchase and get transaction_id: 2000000395609292, and then another user just makeup a same transaction_id to call the App Store Server API

If in the old way, the receipt seems impossiable to makeup, how about now? Is that equally safe as before?

Or is there any way to protect transaction_id.

I am not that good at security, so please forgive me about missing any point. o(╥﹏╥)o

Looking forward to your response, sincerely!! :)

How is this transaction ID generated ?

.

another user just makeup a same transaction_id

AFAIK it should be unique. So how could it be ?

I mean it just number, I can guess a random number. Is that possible?

If in the old way, the receipt seems impossiable to makeup, how about now? Is that equally safe as before?

Which old way do you mean ? What is the new way ?

Where is the ID generated ?

How to guarantee that user won't be able to makeup transaction_id to call new api
 
 
Q