Forward store notifications

Receive a copy of each App Store or Google Play notification Voidhash accepts on your own server.

Voidhash can forward a copy of each store notification it receives to your server, exactly as the store sent it: App Store Server Notifications, and Google Play real-time developer notifications. Use it when another system, such as the one you're migrating from, still needs them. Forwarding doesn't change how Voidhash processes a notification or answers the store.

For most backends, webhooks are simpler: one format for every store, signed by Voidhash.

Set up forwarding

Create an endpoint that accepts JSON POST requests at a public HTTPS URL. Voidhash rejects http URLs and private or internal addresses, such as localhost, both when you save and when it delivers.
In Studio, paste the URL into the provider's forwarding field: App Store or Google Play (Help center).
Send a test notification. Voidhash forwards test notifications too:
- App Store: call the App Store Server API's Request a Test Notification endpoint.
- Google Play: click Send Test Message under Real-time developer notifications in Play Console.

Voidhash forwards only what it receives, so the store's notifications must reach Voidhash first.

What your endpoint receives

A POST whose body is Apple's notification, unchanged:

{ "signedPayload": "eyJhbGciOiJFUzI1NiIsIng1YyI6WyJNSUlF..." }

Header	Value
`Content-Type`	`application/json`
`User-Agent`	`Voidhash-Notification-Forwarder/1.0`
`X-Voidhash-Forwarded-From`	`apple-app-store`
`X-Voidhash-Notification-Id`	The notification's `notificationUUID`

Voidhash forwards a notification only after verifying Apple's signature, but doesn't sign the forwarded request. Verify signedPayload as Apple documents in responseBodyV2 before you trust it.

A POST whose body is the Pub/Sub push message:

{
  "message": {
    "attributes": {},
    "data": "eyJ2ZXJzaW9uIjoiMS4wIiwicGFja2FnZU5hbWUiOiJjb20uZXhhbXBsZS5hcHAifQ==",
    "messageId": "136969346945",
    "publishTime": "2026-10-25T12:00:00.000Z"
  },
  "subscription": "projects/example-project/subscriptions/voidhash-rtdn"
}

message.data is the base64-encoded notification described in Google's RTDN reference. Other Pub/Sub fields are forwarded unchanged.

Header	Value
`Content-Type`	`application/json`
`User-Agent`	`Voidhash-Notification-Forwarder/1.0`
`X-Voidhash-Forwarded-From`	`google-play`
`X-Voidhash-Notification-Id`	The Pub/Sub `message.messageId`

Voidhash forwards a notification only when the push is authenticated and names the provider's package. It doesn't forward Pub/Sub's Authorization token or sign the request, so treat a notification as a signal and confirm the purchase with the Google Play Developer API before you grant anything.

Delivery and retries

Each notification is forwarded once, even when the store delivers it again.
Answer with a 2xx status within 15 seconds.
After any other status, a redirect, a timeout or a connection error, Voidhash retries after about 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours, then gives up. Redirects aren't followed.
A retry can repeat a request you already handled. Deduplicate with X-Voidhash-Notification-Id.
Requests can arrive out of order. Order App Store notifications by signedDate in the decoded payload, and Google Play ones by eventTimeMillis in the notification.
Each attempt uses the URL saved at that moment. Clearing the URL stops pending retries.

Next steps

Something wrong or missing on this page? Tell us by email or on Discord.