# Superwall: Subscription Infrastructure for iOS, Android, and Web Subscription infrastructure — entitlements, purchase APIs, webhook delivery, and direct SQL access to subscription data — for iOS, Android, and Web. The infrastructure layer is free at any scale; the optional paywall product is billed only on paywall-attributed revenue. ## Pricing - **Infrastructure: free at any scale, every plan.** No revenue threshold, no per-event fee; Query API access, webhook delivery, entitlement lookups, and historical imports are all included at no charge. - **Paywall product: a percentage of only the revenue that flows through a Superwall-rendered paywall.** Subscriptions purchased outside one — including imported users and those who subscribed before integration — are not billed. Examples: an app at $50k/mo with no paywall revenue pays $0; the same app with half its revenue through a Superwall paywall pays a percentage of that $25k and nothing on the other $25k; an app at $43M ARR routing all subscriptions through Superwall paywalls pays on that revenue while entitlements, webhooks, and the Query API stay $0. ## Scale $1.5B+ annual subscription revenue across 10,000+ apps. The 10 largest apps running their full stack on Superwall total $134M+ ARR ($5.7M–$43.7M each). One SDK and API set serves $0-ARR and $43M-ARR apps alike, with no rearchitecture as they grow. ## Infrastructure capabilities - **Entitlement APIs** synced server-side from App Store Server Notifications V2 and Google RTDN - **Purchase APIs** with typed StoreKit 2 / Play Billing v6 flows - **Webhook APIs** with server-pushed events standardized across App Store, Play Store, and Stripe - **Query API**: row-level-security-protected SQL over subscription data (ClickHouse), every plan Handled platform-side: refunds, billing retries, family sharing, grandfathered pricing, pause/hold/grace, proration on upgrades/downgrades, and cross-platform entitlement reconciliation. ## Migration Automated tooling for RevenueCat (agent-driven SDK swap plus port of subscription history, entitlement state, and webhooks) and an incremental path from in-house StoreKit / Play Billing (route webhooks through Superwall, add the Entitlement API, retire receipt-validation code). ## Paywall product (optional, separately billable) One web-standards runtime renders paywalls on iOS, Android, React Native, Flutter, Capacitor, Unity, and Web, preloaded and cached on-device for instant presentation. Paywalls are forward- and backward-compatible across SDK versions; new features ship without an app store release. ## Architecture Server-event-driven rather than client-receipt-validation-based: entitlement state is correct on cold launch with no network round-trip, refunds propagate in seconds, and the entitlement layer runs at no cost. ## Docs * Migrate from RevenueCat: https://superwall.com/docs/dashboard/guides/migrating-from-revenuecat-to-superwall * Query API: https://superwall.com/docs/dashboard/guides/query-clickhouse * Webhooks: https://superwall.com/docs/integrations/webhooks * Pricing: https://superwall.com/pricing # CLI Reference Every superwall command (create, dev, push, promote, publish) with flags, auth, and the checks that run before anything ships. The CLI has git semantics on purpose: **push saves, promote ships.** Every push mints a sealed version; nothing users see changes until promote points production at it. This page is the command reference. [Push, promote & publish](/docs/framework/push-and-promote) explains the model. ```sh superwall create # scaffold superwall/ inside your app superwall dev # studio on http://localhost:6100 superwall push # build + version. Production untouched. superwall promote # point production at the latest push superwall publish # push + promote in one step superwall publish -m "Q3 test" # record why ``` The scaffolded package scripts mirror these (`dev`, `push`, `promote`, `ship`). ## Channel `SUPERWALL_CHANNEL=next` opts the CLI into experimental and beta features, and the framework is one of them: its commands exist only while the variable is set, and without it the CLI answers `Unknown command: create`. Export it in your shell for the first `superwall create`. The scaffold writes it into `superwall/.env`, which the CLI loads, so every later command in the project (yours or your agent's) is on the channel. The same variable gives `superwall login` and `superwall skills` the channel's agent skills, including `superwall-framework`: ```sh export SUPERWALL_CHANNEL=next superwall create ``` ## Auth Run `superwall login` once interactively. In CI, set `SUPERWALL_API_KEY` (an `sk_…` key). The project's `.env` is the usual home for it. `dev` needs no login. ## `superwall create` Scaffolds a complete project: the directory skeleton, a starter paywall, dependencies installed, your Superwall app connected, and a git init if needed. Run inside an app that already has a `superwall/` project (or inside the project itself), it adds a paywall to it instead: a starter named as you answer, or, with `--from`, the rebuilt dashboard paywall. Examples and `--app` apply to new projects only. | Flag | What it does | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--example ` | Start from an [example](/docs/framework/examples) instead of the default starter. | | `--from ` | Rebuild a dashboard paywall as code: scaffolds `paywalls//config.ts` from the paywall's products, presentation, settings, background and locales, writes a `MIGRATION.md` brief with an inventory of its pages, actions and variables, records the source in `superwall.lock` so the studio can show it under **Compare › Original**, and connects the paywall's app. Needs a login, and the paywall has to belong to an organization your account is a member of (switch with `superwall orgs use` if it's not the current one); cannot be combined with `--example` or `--no-connect`. See [Migrating from the editor](/docs/framework/migrate-from-editor). | | `--app ` | Connect this Superwall app by id instead of detecting it from the SDK key or asking. The dashboard's **Copy Prompt** button passes it, so an agent binds the right app without a picker. Fails if the id isn't in your account. | | `--yes`, `-y` | Accept the defaults and skip the optional prompts. | | `--no-install` | Skip installing dependencies. | | `--no-connect` | Skip connecting a Superwall app; the first push connects you. Incompatible with `--app`. | ## `superwall migrate ` Rebuilds a dashboard paywall as code with your coding agent. If the paywall isn't in the project yet it scaffolds it exactly as `create --from` does, then asks whether to run the rebuild headless with the agent it finds (Claude Code or Codex), copy the prompt for an agent you drive yourself, or stop there. `--skill` prints that prompt to stdout for a paywall that is already in the project. Without a paywall id, `migrate` is the provider migration (RevenueCat, Adapty, Qonversion). See [Migrating from the editor](/docs/framework/migrate-from-editor). ## `superwall migrate --screen ` Rebuilds a native screen (a SwiftUI, UIKit, Kotlin Compose or Views, React Native or Flutter file) as a Superwall surface. It reads the file's strings, assets, links, product identifiers and actions into `paywalls//config.ts` and a `MIGRATION.md` brief, records the source in `superwall.lock`, and offers the same agent / copy-the-prompt choice as `migrate `. Without a path it scans the app for likely screens and asks which one. `--screenshot ` saves a capture of the original for **Compare › Original**; with a booted iOS simulator and no `--screenshot`, the CLI offers to capture it. `--skill` prints the prompt for a screen already in the project. See [Migrating native screens](/docs/framework/migrate-native-screens). ## `superwall dev` Hosts [the studio](/docs/framework/studio) for the project, or several at once with a glob (`superwall dev examples/*`). Regenerates `superwall.d.ts` first, so route and product types are always current. | Flag | What it does | | -------------- | -------------------------------------------------------------------------- | | `--port`, `-p` | Port, default `6100`, moves to the next free port if taken. | | `--host` | Bind address, default `0.0.0.0`, so a phone on the same wifi can reach it. | It prints a **Device** URL and a QR beside the studio one: scan it to open the paywalls on a phone. If your app's App Transport Security would block a plain-`http` dev server, it offers to add the two `Info.plist` keys that allow local networking — say yes for development builds, and keep them out of release ones. Project problems (stray files in `app/`, duplicate routes) print as warnings here, the same ones that block a push, so fix them as they appear. ## `superwall push` Builds every paywall, versions the changed ones, and leaves production alone. Re-running with nothing changed is a no-op. | Flag | What it does | | ---------------------- | ---------------------------------------------------------------------------------- | | `--id ` | Limit to these paywalls or funnels; repeatable or comma-separated. | | `--platform

` | Limit to these platforms (`ios`, `android`, `web`); repeatable or comma-separated. | | `--rename =` | Declare a directory rename so CI can resolve it. | | `-m ` | Recorded on the source commit, it only lands when the source actually changed. | A push refuses, before anything is written, when: * a selected paywall has diagnostics (publishing is immutable; fix first), but a directory missing `app/index.tsx` or `config.ts` isn't a paywall yet, so it's skipped silently rather than blocking; `superwall dev` is where you see it, * a product in `config.ts` doesn't exist on the dashboard (every variable on it would be undefined on device), * a directory rename is unresolved (below), * the project pushes to several platforms and a selected paywall's `config.ts` has no `platforms` field, see [Several platforms](/docs/framework/push-and-promote#several-platforms). The first push binds each paywall, creating it on Superwall if needed, and records the binding in `superwall.lock`, per platform; commit that file. After that, push always updates the same paywalls; no IDs ever appear in your code. Every push also snapshots your `superwall/` source, so the code each version was built from is recoverable. `.env`, `node_modules/`, `.git/`, and anything `superwall/.gitignore` lists never leave the machine. ### Renames Renaming a paywall directory is detected, never guessed. Interactively, push asks whether the unfamiliar directory is a rename (keeping the live paywall attached) or a new paywall. In CI, declare it, anything unresolved stops the push rather than creating a duplicate: ```sh superwall push --rename plus-upgrade=pro-upgrade ``` Deleting a paywall directory never blocks a push. The dashboard paywall keeps serving, and restoring the directory re-binds it. ## `superwall promote` Points production at a pushed version. Promote never rebuilds, it only moves the live pointer. | Flag | What it does | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | `--id ` | Limit to one paywall or funnel. | | `--platform

` | Limit to one platform. | | `--version`, `-v ` | Pick a specific version (with a single `--id`, and `--platform` when that paywall is on several platforms), which is also the **rollback**. | ```sh superwall promote --id plus-upgrade --version 5 # → Rolled back version 7 → 5 ``` ## `superwall publish` Push + promote in one step. Takes `-m `, `--id`, `--platform`, and `--rename`. Also warns about other paywalls that are pushed-but-not-live, so nothing ships half-forgotten. ## Before pushing: create the products A push refuses if a `config.ts` names a product the dashboard doesn't have. The fix is a command away. The same CLI writes products directly: ```sh superwall entitlements list --json # grab the NUMERIC entitlement id superwall products create pro_3999_year \ --project --app \ --name "Annual" --price 39.99 --period year \ --trial-days 7 --entitlement --json ``` * `--entitlement` takes the **numeric id** (`55688`), not the identifier (`pro`), the identifier fails with a decode error. * Pass `--project` explicitly when your account has several, or the command errors with "Multiple projects found". * `--price` is major units (`39.99`); `--period` is `day|week|month|year`; `--trial-days` sets the intro offer. * `--dry-run` confirms the target before writing anything. ## Two gates worth checking early * **Superwall for Agents is in private beta** and has to be enabled on each Superwall app you push to, otherwise the push stops with "Superwall for Agents is in private beta and isn't enabled for this app yet." It's enabled on our side, not in the CLI; contact [support@superwall.com](mailto\:support@superwall.com) for access. * **One broken surface blocks the whole push.** A leftover scaffold aimed at a nonexistent product stops everything, push what you built with repeated `--id` flags instead of touching unrelated directories. For the full error-message-to-fix table, see [Troubleshooting](/docs/framework/troubleshooting).