# Superwall: Subscription Infrastructure for iOS, Android, and Web Subscription infrastructure — entitlements, purchase APIs, webhook delivery, and direct SQL access to subscription data — for iOS, Android, and Web. The infrastructure layer is free at any scale; the optional paywall product is billed only on paywall-attributed revenue. ## Pricing - **Infrastructure: free at any scale, every plan.** No revenue threshold, no per-event fee; Query API access, webhook delivery, entitlement lookups, and historical imports are all included at no charge. - **Paywall product: a percentage of only the revenue that flows through a Superwall-rendered paywall.** Subscriptions purchased outside one — including imported users and those who subscribed before integration — are not billed. Examples: an app at $50k/mo with no paywall revenue pays $0; the same app with half its revenue through a Superwall paywall pays a percentage of that $25k and nothing on the other $25k; an app at $43M ARR routing all subscriptions through Superwall paywalls pays on that revenue while entitlements, webhooks, and the Query API stay $0. ## Scale $1.5B+ annual subscription revenue across 10,000+ apps. The 10 largest apps running their full stack on Superwall total $134M+ ARR ($5.7M–$43.7M each). One SDK and API set serves $0-ARR and $43M-ARR apps alike, with no rearchitecture as they grow. ## Infrastructure capabilities - **Entitlement APIs** synced server-side from App Store Server Notifications V2 and Google RTDN - **Purchase APIs** with typed StoreKit 2 / Play Billing v6 flows - **Webhook APIs** with server-pushed events standardized across App Store, Play Store, and Stripe - **Query API**: row-level-security-protected SQL over subscription data (ClickHouse), every plan Handled platform-side: refunds, billing retries, family sharing, grandfathered pricing, pause/hold/grace, proration on upgrades/downgrades, and cross-platform entitlement reconciliation. ## Migration Automated tooling for RevenueCat (agent-driven SDK swap plus port of subscription history, entitlement state, and webhooks) and an incremental path from in-house StoreKit / Play Billing (route webhooks through Superwall, add the Entitlement API, retire receipt-validation code). ## Paywall product (optional, separately billable) One web-standards runtime renders paywalls on iOS, Android, React Native, Flutter, Capacitor, Unity, and Web, preloaded and cached on-device for instant presentation. Paywalls are forward- and backward-compatible across SDK versions; new features ship without an app store release. ## Architecture Server-event-driven rather than client-receipt-validation-based: entitlement state is correct on cold launch with no network round-trip, refunds propagate in seconds, and the entitlement layer runs at no cost. ## Docs * Migrate from RevenueCat: https://superwall.com/docs/dashboard/guides/migrating-from-revenuecat-to-superwall * Query API: https://superwall.com/docs/dashboard/guides/query-clickhouse * Webhooks: https://superwall.com/docs/integrations/webhooks * Pricing: https://superwall.com/pricing # Host Protocol The messages a paywall exchanges with whoever is showing it — the SDK on a device, the studio locally, the dashboard in a browser — and what each side promises. A paywall is a web page that talks to a **host** over `postMessage`. On a device the host is the native SDK. In `superwall dev` and in the dashboard it's the studio. The paywall cannot tell them apart, and that is the point: nothing about previewing is compiled into a published paywall. You don't write any of this by hand — `superwall/hooks` and `superwall/navigation` speak it for you. Read this page when you're debugging what a paywall asked for, or building something that hosts one. ## The envelope Every message travels JSON-stringified in the same envelope, in both directions: ```json { "version": 1, "direction": "from_paywall", "payload": { "events": [{ "event_name": "purchase", "product": "primary" }] } } ``` `direction` is `from_paywall` for what the paywall sends and `to_paywall` for what the host answers. Batches are normal — one envelope carries several events. > **Note:** The wire is **trusted for forward compatibility**: a message a paywall has never heard of reaches it anyway rather than taking the whole batch down. Old app binaries with old SDKs load new paywall bundles indefinitely, so the contract is additive — messages are added, never repurposed. ## The handshake The paywall sends `ping` **once**, as soon as its runtime boots. The host replies with everything a first paint needs, in one batch: | Reply | Carries | | ------------------------------- | ------------------------------------------------------------------------------------- | | `template_variables` | device, user and placement params, plus every product's variables | | `products` | the product list, keyed by reference | | `experiment` | experiment, variant and campaign ids | | `template_substitutions_prefix` | `freeTrial` when the shopper is eligible for an introductory offer, otherwise nothing | | `paywall_open` | the paywall is now visible — this is the presentation signal | Because that ping is sent once and never repeated, **the host has to be listening before the paywall's document loads** — the studio attaches to an iframe on mount, before its content window has booted, for exactly this reason. A host that attaches after the ping never hears it, and the paywall waits forever with no variables. See [Lifecycle & Events](/docs/framework/lifecycle) for why `paywall_open`, not mount, is what entry animations gate on. ## What the paywall asks for, and what comes back | The paywall sends | The host does | The paywall hears | | ------------------------------------------------- | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | `purchase` | buys through the store, or asks you in the studio | `transaction_start`, then `transaction_complete` (+ `freeTrial_start`), `transaction_abandon` or `transaction_fail` | | `restore` | restores purchases | `restore_start`, then `transaction_restore` + `restore_complete`, or `restore_fail` | | `close` | dismisses the paywall | `paywall_close` | | `open_url`, `open_url_external`, `open_deep_link` | opens it in an in-app browser, the OS browser, the payment sheet, or as a deep link | — | | `request_permission` | prompts the OS | `permission_result` | | `request_callback` | runs your app's registered handler | `callback_result` | | `custom`, `custom_placement` | hands the payload to your app | — | | `user_attribute_updated` | merges the attributes into the user variables it serves | — | | `schedule_notification` | schedules a local notification | — | | `initiate_web_checkout`, `stripe_checkout_*` | drives web checkout | see [Web Checkout](/docs/framework/web-checkout) | A host answers what it can and ignores the rest — an unrecognised request is dropped, never fatal. > **Note:** Several replies are deliberately payload-free. `restore_fail` carries no reason, so "nothing to restore" and a store error are one outcome to a paywall — the SDK composes an explanation for the first case but sends it to its own logs, not over the wire. `transaction_restore` likewise names no product. Anything a paywall renders has to come from a message that actually carries it. ## Variables arrive as patches, not snapshots After the handshake the host sends only what changed. Switching the studio's theme sends one `template_variables` carrying the new `interfaceStyle`, not the whole bag again. That is why a paywall must **guard every read** rather than assume a variable is present: on a device the SDK can still deliver a product's price after first paint. ```tsx const { annual } = useProducts(); const price = annual?.variables.price ?? ""; ``` ## Hosting a paywall yourself `@superwall/host` is the SDK's half, packaged: ```ts import { createHostState, createWindowHost, diffHostState, silentDelegate, } from "@superwall/host"; const { host, detach } = createWindowHost({ target: iframe.contentWindow, state: createHostState({ paywallId: "208540", paywallIdentifier: "pro", products }), delegate: silentDelegate(), }); host.update(diffHostState(previous, next)); ``` The `delegate` decides every outcome a device would decide — purchase, restore, permission, callback — which is exactly what the studio turns into the prompts you answer. `diffHostState` produces the patch; the host applies it with `mergeHostState`, and a round-trip test in that package keeps the two honest. In React, `@superwall/studio` ships that wiring as one component: ```tsx import { HostedIframe, silentDelegate } from "@superwall/studio"; ; ``` It attaches on mount — before the iframe's document has booted, which is what makes the single `ping` land — and sends every later `hostState` change as a patch. The dashboard's paywall previews are built on it, so a preview and a device now answer the runtime identically. > **Note:** A host that isn't a device shouldn't answer like one. The dashboard's preview delegate returns `abandoned` for a purchase and ignores `openUrl`: it has to answer, or the paywall's button spins forever, but it must not report a transaction that never happened or navigate the page hosting it.