Engineering guides / Native Apple app development
By Arte Soft engineering · 24 October 2026
App Store Server Notifications: build a ledger, not just a webhook
A webhook that returns success is not proof that subscriptions and credits are correct. Server notifications must become consistent business state even when events repeat, arrive late or are missed during an outage. Design the ledger and recovery process before relying on the endpoint for customer access.
The decision to make
Start with the events your product needs to act on. A renewal might extend access and grant credits; a refund may require revoking an entitlement under your policy. Deduplicate delivery using notificationUUID while retaining transaction identity, notification type and processing outcome separately from the current balance. A refund or revocation can refer to the original transaction; do not suppress a new lifecycle event merely because its transactionId is already known.
Verify signed information using the appropriate Apple-supported approach and keep sandbox and production context explicit. Do not trust a client-supplied claim that it purchased a product. A notification should be checked against the intended application and environment before it changes state. Logging should help investigate failures without leaking complete personal or payment-related records.
A useful scope of work
The implementation scope includes the HTTPS endpoint, verification, durable processing, deduplication and event-to-policy mapping. Decide when to acknowledge delivery: a transient database error must not be disguised as a successfully applied grant. Keep error handling compatible with retries and document how the team inspects an event that was received but not applied.
Add reconciliation using the appropriate App Store server information rather than treating the notification stream as infallible. Exercise a test notification, then test meaningful purchase lifecycle events. A successful TEST proves endpoint communication, not the correctness of credit grants or refunds. Provide an operational procedure for outages and an audit trail for manual support decisions.
Acceptance checks to agree before delivery
A notification endpoint should be accepted through its business effect, not an isolated HTTP response. Inspect the durable event and resulting customer state, including repeated delivery. These checks separate connectivity from correct processing and require a recovery route when an outage or partial failure interrupts the normal purchase lifecycle.
- Validate the configured endpoint using Apple’s test mechanism and record the resulting delivery status.
- Replay an already processed transaction and show that the customer balance and entitlement remain unchanged.
- Simulate a processing failure and confirm that retry or reconciliation can restore the intended business state.
- Trace a renewal or refund from verified event through the ledger to the resulting user-visible access.
Constraints and what to send us
Send product identifiers, bundle identifiers, existing purchase code and the current rules for renewals and credit grants. Scope the production and sandbox configuration separately. A server endpoint can be technically reachable while the wrong app or environment is configured. The acceptance evidence must connect the right notification to the right customer state.
Our own product reference and a starting engagement
Purchase webhook and credit-ledger integration. GPT Realtime Assistant provides an owned subscription-and-credit product reference. That supports a relevant architecture discussion without asserting a particular server implementation publicly. A bounded engagement can implement one lifecycle end to end and document reconciliation before expanding to every product event.
Relevant Arte Soft work
GPT Realtime Assistant is our own product or engineering project. It provides context for the work we discuss here; it is not a claim of identical results for every client deployment.
Sources and further reading
Need help with Purchase webhook and credit-ledger integration?
Send the current app, system or brief, the behaviour you need and your constraints. We can agree a discovery, implementation or repair scope with concrete acceptance criteria.
Discuss this with Arte Soft