Server-to-server endpoints
The per-connection endpoints that receive App Store Server Notifications, Google Play notifications and Stripe webhooks, with verification and responses.
RevenueHog receives real-time store events at per-connection URLs. You do not call these yourself: you paste the URL into App Store Connect, Google Cloud Pub/Sub or Stripe. The {token} in each URL identifies the connection; treat the URL as a secret. It is never logged.
| Provider | Endpoint | Set up in |
|---|---|---|
| Apple | POST /api/s2s/apple/{token} | Server notifications |
| Google Play | POST /api/s2s/google/{token} | Google Play |
| Stripe | POST /api/s2s/stripe/{token} | Stripe |
Responses are plain text (text/plain; charset=utf-8). A non-2xx response makes the provider retry.
Apple
/api/s2s/apple/{token}URL token + Apple signatureThe body is Apple's { "signedPayload": "<JWS>" }. RevenueHog verifies the JWS against Apple's root certificates and checks it matches the app's bundle ID, Apple ID and environment. Nothing is recorded or forwarded unless it verifies. Notifications are de-duplicated by notificationUUID.
| Status | Body | Meaning |
|---|---|---|
200 | OK | Recorded |
200 | Duplicate | Already recorded; acknowledged without re-alerting |
400 | Bad Request | Not JSON, no signedPayload, or unreadable environment |
401 | Unauthorized | Signature verification failed |
404 | Not Found | Unknown token (404 so the endpoint reveals nothing) |
Recorded events also feed forwarding and push alerts.
Google Play
/api/s2s/google/{token}URL token + Pub/Sub OIDCPushed by your Pub/Sub subscription. The Authorization header carries Google's OIDC token, checked against the connection's audience and service account before the body is read.
| Status | Body | Meaning |
|---|---|---|
200 | OK | Recorded, a test notification, an unknown token, or a message without a package name |
200 | Duplicate | Already recorded |
200 | Bad Request | Undecodable body (acknowledged so Pub/Sub does not retry) |
401 | Unauthorized | OIDC verification failed |
Stripe
/api/s2s/stripe/{token}URL token + Stripe-SignatureVerified with the connection's webhook signing secret and the Stripe-Signature header. Distinct from RevenueHog's own billing webhook.
| Status | Body | Meaning |
|---|---|---|
200 | OK | Recorded |
200 | Duplicate | Already recorded |
200 | Ignored | An event type RevenueHog does not track |
400 | Bad Signature | Signature check failed |
404 | Not Found | Unknown token |
409 | No webhook secret configured | The connection runs in poll mode |
Related
Last updated on
Revenue export API
Download your workspace's revenue lines as a streamed CSV from GET /api/export/revenue, filtered by date range and app, with columns and error responses.
Errors
Every HTTP status and error body the RevenueHog APIs return, what each one means, and whether your client should fix the request, retry with backoff or drop it.