Event forwarding

Apple allows one notification URL per app. Forwarding removes the choice: RevenueHog relays Apple's exact signed payload to your endpoints, so your server keeps working while RevenueHog records every event.

How forwarding worksCopy Anchor Link

When Apple posts a notification, RevenueHog verifies the JWS against Apple's root certificates, records the event, acknowledges Apple, and then re-POSTs the verbatim request body to the forwarding URL for that app and environment:

POST https://your-endpoint.example/apple/notifications
Content-Type: application/json

{"signedPayload":"eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlFTUQuLi4"}

Nothing is re-signed, decoded, reformatted or wrapped. The signedPayload your server receives is the one Apple signed, so your existing verification (x5c chain to Apple's root, ES256) keeps working unchanged. No extra HMAC or shared secret is needed: anyone who cannot forge Apple's signature cannot forge a forwarded event either.

Endpoints and URL rulesCopy Anchor Link

Each App Store app has two optional URLs under FORWARDING ENDPOINTS on its page: Production and Sandbox. Press Save forward URLs. Production events go only to the production URL, sandbox events only to the sandbox URL. An event whose environment has no URL is recorded and marked skipped, never mis-routed.

URLs are validated on save:

If your receiver runs on an internal hostname, put it behind a public HTTPS endpoint first. Auto-wiring fills these fields with the URL Apple was using before; see Server notifications.

Delivery and retriesCopy Anchor Link

• A delivery succeeds on any 2xx. Each attempt has a 30-second limit (a host that never completes a connection fails after about 10 seconds).
• Failures are retried by the queue, up to five retries.
• An hourly sweep re-sends events still pending, and events that failed within the last 72 hours (matching Apple's own retry horizon), up to 50 recorded attempts per event.
• A URL with at least 30 attempts in 7 days and no delivery stops being re-driven by the sweep. New events still get their normal retries, and the first success clears this.

Every attempt is logged with target, attempt number, HTTP status and error, and is visible on the event's detail in the live feed.

Never-delivered URLsCopy Anchor Link

A URL that has failed 50 times without ever accepting a delivery is paused. The app page shows PRODUCTION · NEVER DELIVERED · PAUSED with: "The Production URL has never accepted a notification. It has failed N times, so RevenueHog has paused forwarding to it and tries it once a day. Save a corrected URL to resume, or wait for a daily try to succeed. Either way, notifications from the last 72 hours are then sent to it."

A URL that has delivered even once is never paused.

Downstream verificationCopy Anchor Link

Treat forwarded notifications exactly like direct ones: verify the signedPayload certificate chain and signature, branch on data.environment, and dedupe on notificationUUID. Forwarding retries, like Apple's own, can deliver duplicates. History imported with Import 180-day history is never forwarded.

Other sourcesCopy Anchor Link

Forwarding applies to Apple notifications. For Google Play, add a second Pub/Sub subscription for your own server. For outbound webhooks of RevenueHog's normalized events, see Webhooks.

RelatedCopy Anchor Link