App Store Connect webhooks
Connect App Store Connect webhooks so App Review, build and TestFlight events reach RevenueHog instantly, using Admin auto-setup or a manual URL and secret.
App Store Connect webhooks deliver app version state changes, build processing and TestFlight feedback in real time. They are separate from subscription server notifications. Without a webhook, version and TestFlight changes arrive on the regular sync instead.
Events RevenueHog subscribes to
| App Store Connect label | Event type |
|---|---|
| App version state | APP_STORE_VERSION_APP_VERSION_STATE_UPDATED |
| Build upload state | BUILD_UPLOAD_STATE_UPDATED |
| External build state | BUILD_BETA_DETAIL_EXTERNAL_BUILD_STATE_UPDATED |
| TestFlight crash feedback | BETA_FEEDBACK_CRASH_SUBMISSION_CREATED |
| TestFlight screenshot feedback | BETA_FEEDBACK_SCREENSHOT_SUBMISSION_CREATED |
Version state changes become VERS rows in the feed and, for transitions worth interrupting you for (accepted, in review, rejected, live), a push alert. TestFlight feedback events trigger a feedback sync. Build upload events are recorded but not yet surfaced.
Connect
Webhooks are created only when you press a button, never automatically.
- One app: on the app page, press Connect webhook.
- All apps: under Settings → Connections → APP STORE CONNECT → WEBHOOKS, press Connect N apps. It stops at the first permission refusal.
Creating a webhook requires an Admin key. The card then reads "Connected. Apple now sends App Review, build and TestFlight events here."
Without an Admin key
The card reads "This App Store Connect key can't create webhooks (Apple requires the Admin role). Create one yourself for this app with the URL and secret below, or save an Admin key and connect again." and shows a URL and Secret. In App Store Connect, create a webhook for the app with that URL and secret, subscribed to the events above. The secret is already stored, so deliveries verify without another step.
Card actions and messages
| Action | Possible messages |
|---|---|
| Check | "Apple has an active webhook pointing here." / "The webhook exists but is switched off in App Store Connect. Turn it back on there." / "Apple has no webhook pointing here. Connect it again." |
| Send test | "Test sent. Apple usually delivers it within seconds." / "Test failed: …" |
| Remove | "Removed. Apple no longer sends events here." / "Couldn't remove it: …" |
| Any | "Connect App Store Connect first." / "This app is no longer in your workspace." / "Apple returned an error: …" |
The card also shows when it was last checked and the last delivery.
Security
Deliveries go to /api/asc-webhook/<token>. Apple signs the raw body with HMAC-SHA256 using the webhook's secret, sent as x-apple-signature: hmacsha256=<hex>; RevenueHog verifies it with a timing-safe comparison before parsing. Each delivery is stored first and processed from a queue, and redeliveries are deduplicated by Apple's event ID.
Related
Last updated on
Server notifications
Route App Store Server Notifications V2 through RevenueHog with the per-app ingest URL, the S2S audit, one-step auto-wiring, test sends and history import.
Event forwarding
RevenueHog relays Apple's exact signed notification payload to your own endpoints, with per-environment URLs, retries, paused dead URLs and verification.