Set Up App Store Server Notifications V2

App Store Server Notifications are signed webhook payloads. Decode-only JWT helpers are not verification. Reject any notification that fails certificate-chain, signature, environment, bundle-ID, or app-ID validation before it can update entitlement state.

Required controls

• Use Apple's current App Store Server Library and its SignedDataVerifier rather than jsonwebtoken.decode.
• Load Apple root certificates from a trusted, versioned server-side source.
• Configure the expected bundle ID, production app Apple ID, and environment explicitly.
• Verify the outer notification and every nested signed transaction or renewal record you consume.
• Make event processing idempotent by persisting a verified event identifier before applying state changes.
• Keep this endpoint server-side. It must never rely on an app-bundled signing key or a client-provided "verified" flag.

Verified handler pattern

import { Environment, SignedDataVerifier } from '@apple/app-store-server-library';