User Profile

How can I verify that server-to-server notification comes from Apple, and not from third-party malefactor?Maybe we could get some IP-ranges, from which Apple send notifications?Or maybe we should make request to AppStore to get info by receipt from notification, and compare it with json?Or maybe it possible to exchange keys? or use existed keys to verify source of request?Is there any best practices?Thank you.Anna

I have some questions about CANCEL notification.First of all, as i understand from documentation https://developer.apple.com/library/content/documentation/NetworkingInternet/Conceptual/StoreKitGuide/Chapters/Subscriptions.html,notification CANCEL comes to backend server only if user make refund from AppStore. Is it right? Or maybe there are other cases when it may come?Second question. If user made refund, and we got cancel notification, after few month he bought the same product as earlier. Which notification comes to server and App, with the same original_transaction_id as in previous (refunded) purchase, or it would be absolutly new purchase?