SlipwaySoonon the Mac App Store
DocsWebhooks

More App Store Connect

Webhooks

Add App Store Connect webhooks for an app in Slipway so Apple notifies your server when a version, build upload or TestFlight build changes state.

With a webhook, App Store Connect calls your server when something changes. Slipway sets up hooks for one app at a time. Open the app and click Webhooks under Services in the left sidebar.

Slipway only manages the hooks. Apple sends the events straight to your server; none of them go through Slipway.

What you need#

  • An HTTPS endpoint on a server you control that accepts POST requests.
  • A secret string, which Apple uses to sign each delivery. Make it long and random, and store it on your server.

No server? You can skip this page. The menu bar checks for changes by polling App Store Connect instead.

Add a webhook#

  1. Open the app and click Webhooks.
  2. Enter your endpoint URL in the field that shows https://your-endpoint/asc.
  3. Enter your secret in the secret field.
  4. Click Add.

Slipway names the hook "Slipway" and subscribes it to three events:

Event type Sent when
APP_STORE_VERSION_APP_VERSION_STATE_UPDATED An App Store version changes state, for example Waiting for Review → In Review → Ready for Distribution.
BUILD_UPLOAD_STATE_UPDATED An uploaded build moves through processing.
TEST_FLIGHT_BUILD_STATE_UPDATED A build's TestFlight state changes.

To use other event types, or to change a hook's events or URL, edit it in App Store Connect. Slipway doesn't edit existing hooks; to change one here, delete it and add it again.

Check that it works#

Each hook shows its URL and a status line: how many event types it's subscribed to, and either "no deliveries yet" or the result of the most recent delivery (for example "last succeeded · HTTP 200").

  1. Click Ping next to the hook. App Store Connect sends a test event to your URL.
  2. Slipway shows "Webhook pinged" and reloads the list. The status line shows the latest delivery and the HTTP status your server returned.

Note — "Webhook pinged" appears even if App Store Connect rejected the ping request. Always check the status line, or your server logs, to confirm the ping actually arrived.

Verify deliveries on your server#

Apple signs every delivery with HMAC-SHA256 using your secret and puts the signature in the X-Apple-Signature header. Check it before you trust the payload:

  1. Read the raw request body exactly as received, before any JSON parsing.
  2. Compute an HMAC-SHA256 of that body using your secret.
  3. Compare the result with X-Apple-Signature using a constant-time comparison. If they don't match, reject the request.

See Apple's App Store Connect webhook documentation for the exact header format.

Delete a webhook#

  1. Click Delete… next to the hook.
  2. Confirm with Delete. App Store Connect stops sending events to that URL. This can't be undone.

If the hook is still listed afterwards, the delete didn't go through. Try again, or delete it in App Store Connect.

Troubleshooting#

  • Add does nothing. Both the URL and the secret are required. The button stays disabled until both are filled in.
  • An error appears after Add. Apple rejected the hook, and the message at the bottom of the window shows why. Check the URL first. If the URL is fine, the API key's role may not be allowed to manage webhooks. See Create an App Store Connect API key.
  • The status line shows a failed delivery or a 4xx/5xx status. Apple reached your server, but your server returned an error. Check your server logs, then Ping again.
  • The status line stays at "no deliveries yet". Nothing has been sent yet. Ping the hook, or wait for the next state change.
PreviousGame CenterNextSales & Analytics