Forward Apple Server Notifications to your backend

Receive a copy of each App Store Server Notification that Voidhash accepts.

Apple Server Notification forwarding URL is optional. When it is set, Voidhash sends each App Store Server Notification it accepts from Apple to your endpoint, exactly as Apple sent it. Forwarding never changes how Voidhash processes a notification or how it answers Apple.

Prepare an endpoint

Set up an endpoint on your backend that accepts JSON POST requests, for example https://example.com/apple-server-notifications. It must be a publicly reachable HTTPS URL. Voidhash rejects http URLs and addresses on private or internal networks, such as localhost or private IP ranges, when you save. It also refuses to connect if the host resolves to such an address at delivery time.

Enter the forwarding URL

In Voidhash, open the Apple Server notification tab of this payment provider. Paste the URL into Apple Server Notification forwarding URL and save. Clear the field to stop forwarding.

Send a test notification

Ask Apple for a test notification with the App Store Server API's Request a Test Notification endpoint. Voidhash forwards test notifications too, so your endpoint receives a copy.

Voidhash can only forward notifications it receives, so configure Apple Server Notifications first.

What your endpoint receives

Each request is a POST whose body is the App Store Server Notifications V2 body that Apple sent:

{
  "signedPayload": "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlF..."
}

Header	Value
`Content-Type`	`application/json`
`User-Agent`	`Voidhash-Notification-Forwarder/1.0`
`X-Voidhash-Forwarded-From`	`apple-app-store`
`X-Voidhash-Notification-Id`	The notification's `notificationUUID`

Voidhash does not sign forwarded requests. Verify the signedPayload signature as Apple documents in responseBodyV2 before you trust its contents.

Which notifications are forwarded

Voidhash forwards a notification only after it verifies Apple's signature. Test notifications are forwarded too.

Delivery and retries

Voidhash forwards each notification once. When Apple delivers the same notification again, for example as a retry, it is not forwarded again.
Respond with any 2xx status within 15 seconds.
For any other status, a redirect, a timeout, or a connection error, Voidhash retries after about 1 minute, 5 minutes, 30 minutes, 2 hours, and 6 hours, then gives up. Redirects are not followed.
A retry can repeat a request your server already handled, for example after a timeout. Deduplicate with X-Voidhash-Notification-Id.
Requests can arrive out of order. Use signedDate in the decoded payload to order them.
Each attempt uses the URL saved at that moment. Clearing the URL stops pending retries.