Apple App Store setup

Before you begin

You will need, and it takes about 3 to 5 minutes:

• Admin or Account Holder access to App Store Connect.
• An App Store Connect API key, which gives you three values: an Issuer ID, a Key ID, and a .p8 private key file.

No files are uploaded to Apple, and no changes are made to your app binary.

Create your API key

The Issuer ID, Key ID, and .p8 file all come from one place in App Store Connect:

1. Sign in to App Store Connect, open Users and Access, then select the Integrations tab and choose In-App Purchase from the Keys section on the left.
2. Copy the Issuer ID shown at the top of the page. It is a single account-wide value shared by every key you generate.
3. Click the + button next to Active to generate a new key. Name it Refund Sensor, set Access to Admin, and click Generate.
4. Copy the Key ID from the new key, then click the key row to Download the .p8 file. Apple only lets you download it once, so keep it somewhere safe.

Add your credentials

In Refund Sensor, open Add app and choose Apple App Store. Paste your Issuer ID and Key ID, and upload the .p8 file, then click Continue. We verify the key with Apple and encrypt it at rest with AES-256-GCM before storing it. It is never shown again or exposed in logs.

Choose your apps

Once the key is verified, Refund Sensor fetches every app it can see in your App Store Connect account. Search by name or bundle ID, select the apps you want to defend, and click Connect. Each connected app gets its own webhook URL.

Add the webhook URL in App Store Connect

This is the final step, done once per app after it is connected. Apple sends its server notifications to a single URL:

1. Copy the app's webhook URL from Refund Sensor (shown on the connected-app card).
2. In App Store Connect, open that app's App Information page and scroll to App Store Server Notifications.
3. Click Set Up URL for the Production Server URL, paste the URL, and save. Then do the same for the Sandbox Server URL so test and live traffic both reach Refund Sensor.

Each connected app has its own unique URL, generated for you and shown on its card in Refund Sensor. Copy it from there rather than typing it by hand.

Already using RevenueCat, Adapty, or Apphud?

Apple allows only one server-notification URL, and if a subscription platform already uses it, do not replace it. Instead, tell that platform to forward a copy of each raw Apple notification to your Refund Sensor webhook URL, so both keep working. See Notification forwarding for the exact steps for RevenueCat, Adapty, and Apphud.

Verify the connection

Refund Sensor confirms it can receive Apple's notifications before it starts acting on real events. Until the connection is verified, live events are recorded but not acted on, so a half-finished setup never sends a response by mistake.