Question 1

How do I connect IAP Hooks to my app?

Accepted Answer

Create an app in IAP Hooks to get a unique ingest URL. In App Store Connect, open your app's App Store Server Notifications settings and enter that URL for both the Production and Sandbox environments. Then send a test notification from App Store Connect — when the TEST notification appears in your IAP Hooks event log, you're connected. IAP Hooks verifies Apple's signature on every notification, so there's no shared secret to set up.

Question 2

How do I add a destination and choose which events it receives?

Accepted Answer

Add a destination with its URL and authentication (HMAC, bearer token, basic, or custom headers). Pick a payload mode — forward Apple's raw signed JWS, or a decoded JSON version — and set a routing filter so the destination receives only the notification types it cares about. For example, send REFUND and DIDFAILTORENEW to your billing system while sending everything to your data warehouse. Each destination is configured, filtered, and retried independently, so you can add as many as your plan allows.

Question 3

What happens if one of my destinations is down or returns an error?

Accepted Answer

Each destination retries on its own schedule with exponential backoff, so a slow or failing endpoint never blocks the others. If failures persist, a circuit breaker isolates that destination, and once the retry attempts are exhausted the event is moved to the dead-letter queue. From there you can inspect the payload and the last response, then replay it — individually or in bulk — once the endpoint is healthy again. Nothing is silently dropped.

Question 4

How does my server know a forwarded request really came from IAP Hooks?

Accepted Answer

It depends on the payload mode. In raw mode, the request carries Apple's original JWS signature, which your server verifies against Apple's certificate chain — Apple's App Store Server Library handles this verification for you. In decoded or transformed mode, IAP Hooks re-signs the request with your own HMAC secret and adds a signature header following the Standard Webhooks scheme, plus a timestamp — verify that signature on your endpoint to confirm the sender and reject anything that doesn't match. You can rotate the signing secret at any time.

Question 5

How do I test my setup without waiting for a real purchase?

Accepted Answer

Use "Send test event" on any destination to fire a synthetic notification of a chosen type and see exactly what IAP Hooks would deliver. You can also point Apple's Sandbox environment at IAP Hooks and trigger Apple's own TEST notification from App Store Connect. Both flow through the same verification and routing path as production, so what you see while testing is what you'll get live.