App Store Server Notifications - Pearl Medical Knowledge Management

About App Store Server Notifications

App Store Server Notifications provide real-time updates about subscription status changes, purchase events, and other transaction-related activities. Pearl implements these notifications to ensure reliable transaction processing and subscription management.

Overview

App Store Server Notifications are webhook notifications sent by Apple to inform your server about subscription status changes and other events related to in-app purchases. Pearl implements these notifications to ensure reliable transaction processing and subscription management.

These notifications help Pearl maintain accurate subscription status and provide a seamless user experience by automatically handling subscription renewals, cancellations, and other billing events.

Notification Types

INITIAL_BUY

Sent when a user makes their first purchase of a subscription or non-consumable product.

Implemented

RENEWAL

Sent when a subscription automatically renews for another billing period.

Implemented

CANCEL

Sent when a subscription is cancelled by the user or Apple.

Implemented

BILLING_ISSUE

Sent when there's a billing issue with a subscription renewal.

Implemented

REFUND

Sent when a purchase is refunded by Apple or the user.

Implemented

GRACE_PERIOD

Sent when a subscription enters or exits a grace period.

Implemented

Implementation Details

Server Endpoint

Pearl implements a secure webhook endpoint to receive App Store Server Notifications:

POST /api/appstore/notifications

Headers:
"Content-Type": "application/json"
"X-Apple-Signature": "[signature]"

Body: {
  "signedPayload": "[base64-encoded payload]"
}

Security Measures

All notifications are verified using Apple's cryptographic signatures to ensure authenticity and prevent fraud:

Security Features

Cryptographic Signature Verification

Apple Public Key Validation

Timestamp Validation

Transaction Logging

Processing Flow

When Pearl receives an App Store Server Notification, the following process occurs:

Verification: The notification signature is verified using Apple's public key
Decoding: The signed payload is decoded to extract the notification data
Validation: The notification timestamp and transaction details are validated
Processing: The appropriate action is taken based on the notification type
Logging: The transaction is logged for audit and debugging purposes
Response: A 200 OK response is sent to Apple to acknowledge receipt

Error Handling

Pearl implements comprehensive error handling for App Store Server Notifications:

Signature Verification Failures: Invalid signatures are logged and rejected
Malformed Payloads: Corrupted or invalid payloads are logged for investigation
Processing Errors: Failed processing attempts are retried with exponential backoff
Database Errors: Transaction logging failures are handled gracefully
Network Issues: Temporary network problems are handled with retry logic

Testing

Pearl's App Store Server Notification implementation is thoroughly tested using:

Sandbox Environment: All notifications are tested in Apple's sandbox environment
Test Notifications: Apple provides test notification payloads for validation
Mock Payloads: Custom test payloads are used for edge case testing
Load Testing: High-volume notification processing is tested
Security Testing: Signature verification and security measures are validated

Compliance

Pearl's App Store Server Notification implementation complies with:

App Store Review Guidelines: Follows all Apple's requirements for notification handling
Security Best Practices: Implements industry-standard security measures
Data Protection: Ensures user data privacy and security
Audit Requirements: Maintains comprehensive transaction logs
Performance Standards: Meets Apple's performance and reliability requirements