npm install @apple/app-store-server-library

import { SignedDataVerifier, Environment } from "@apple/app-store-server-library";
import fs from "fs";

const appleRootCAs = [
  fs.readFileSync("./certs/AppleRootCA-G2.cer"),
  fs.readFileSync("./certs/AppleRootCA-G3.cer"),
  fs.readFileSync("./certs/AppleComputerRootCertificate.cer"),
];

const verifier = new SignedDataVerifier(
  appleRootCAs,
  true,                      // enable online OCSP checks
  Environment.PRODUCTION,    // or Environment.SANDBOX for testing
  "com.example.myapp",       // your app's bundle ID
  123456789                  // your app's Apple ID (required for production)
);

const decoded = await verifier.verifyAndDecodeNotification(signedPayload);

console.log(decoded.notificationType); // e.g. "DID_RENEW"
console.log(decoded.subtype);          // e.g. null or "GRACE_PERIOD"

// Extract the transaction details (also a signed JWS, decoded automatically)
if (decoded.data?.signedTransactionInfo) {
  const transaction = await verifier.verifyAndDecodeTransaction(
    decoded.data.signedTransactionInfo
  );
  console.log(transaction.transactionId);
  console.log(transaction.productId);
  console.log(transaction.expiresDate);
}

import express from "express";
import { SignedDataVerifier, Environment } from "@apple/app-store-server-library";
import fs from "fs";

const app = express();
app.use(express.json());

const verifier = new SignedDataVerifier(
  [
    fs.readFileSync("./certs/AppleRootCA-G2.cer"),
    fs.readFileSync("./certs/AppleRootCA-G3.cer"),
    fs.readFileSync("./certs/AppleComputerRootCertificate.cer"),
  ],
  true,
  Environment.PRODUCTION,
  process.env.APPLE_BUNDLE_ID,
  process.env.APPLE_APP_ID ? Number(process.env.APPLE_APP_ID) : undefined
);

app.post("/webhooks/apple", async (req, res) => {
  const { signedPayload } = req.body;

  if (!signedPayload) {
    return res.sendStatus(400);
  }

  // Always respond quickly — Apple retries on timeout
  res.sendStatus(200);

  try {
    const notification = await verifier.verifyAndDecodeNotification(signedPayload);
    const { notificationType, subtype } = notification;

    // Decode the transaction if present
    let transaction;
    if (notification.data?.signedTransactionInfo) {
      transaction = await verifier.verifyAndDecodeTransaction(
        notification.data.signedTransactionInfo
      );
    }

    switch (notificationType) {
      case "SUBSCRIBED":
        // New subscription or resubscribe — grant access
        await grantAccess(transaction);
        break;

      case "DID_RENEW":
        // Renewal — extend access period
        await extendAccess(transaction);
        break;

      case "DID_CHANGE_RENEWAL_STATUS":
        if (subtype === "AUTO_RENEW_DISABLED") {
          await flagForWinBack(transaction);
        }
        // AUTO_RENEW_ENABLED — clear cancellation flags
        break;

      case "DID_FAIL_TO_RENEW":
        if (subtype === "GRACE_PERIOD") {
          await notifyPaymentIssue(transaction);
        } else {
          await restrictAccess(transaction);
        }
        break;

      case "EXPIRED":
        await revokeAccess(transaction);
        break;

      case "REFUND":
        await revokeAccess(transaction);
        break;

      default:
        console.log(`Unhandled notification: ${notificationType}/${subtype}`);
    }
  } catch (error) {
    console.error("Failed to verify Apple notification:", error);
  }
});