Changelog

0.7.0 (2026-11-09)

Notifications and alerts: subscribe a tenant or one app to Telegram, email or webhook notifications for purchases, subscriptions, refunds, chargebacks and operational alerts, with event filters, a minimum level, environments and language. CLI notify.
Ad impression revenue: POST /v1/ads/impressions, daily reconciliation against LevelPlay and MAX reports, stats and export. SDK 0.6.0 adds Kasskeep.ads.reportImpression and the converters levelPlayImpression, maxImpression and adMobPaidEvent.
Web console at app.kasskeep.com and the public status page.
The CLI ships as the npm package @kasskeep/cli.
CCBill channel (Beta): FlexForms checkout and webhook events. It only takes effect after you configure CCBill credentials.

One ad unit name can hold several ids per network (up to 20), so iOS and Android ad units share a name. Each id can carry an ios or android label for display; matching ignores it.
PUT .../ad-units/:name accepts a string, an array of ids or {id, platform} objects, or null. GET adds units with the full form.
CLI unit-set accepts repeated flags, comma-separated ids and ios: / android: prefixes.
Official AdMob and LevelPlay test ad units, or apps with the new ads_allow_shared_test_units setting, can share one id across names. The callback picks the name the client sent back.
LevelPlay app_key accepts several comma-separated App Keys.

New ad network: Unity LevelPlay S2S callbacks with md5 signatures, a timestamp window, eventId deduplication, an optional source IP allowlist and the <eventId>:OK acknowledgement.
Test rewards can take the shape of a specific network with network.
SDK 0.5.0: RewardedProvider.init, serverParams on showRewarded, ads.appKey, testAds.network, and KasskeepWeb.configureTestAds({ network }).

Rewarded-ad callbacks for ad units that are not mapped are now rejected by default. New app setting ads_unmapped_policy (reject or emit).
New endpoint GET .../ads/unmatched and CLI ads unmatched list rejected ad units.
Test rewards for an unknown ad unit name return 422 unknown_ad_unit.

Rewarded ads: AdMob SSV and AppLovin MAX S2S callbacks, the ad.reward event, ad unit mapping, test mode, and GET /v1/customers/:id/ad-rewards.
SDK 0.4.0: Kasskeep.ads.showRewarded with an injected RewardedProvider; the WebView bridge and kasskeep-web.js forward it.
Fix: the default fetch on web no longer fails with Illegal invocation.

Stripe channel: hosted Checkout through POST /v1/checkout, verified webhooks that re-fetch from the Stripe API, refunds, the new chargeback and chargeback.closed events, product mapping, return host allowlist and hourly reconciliation.
SDK 0.3.0: checkout(); kasskeep-web.js adds configureCheckout and checkout.

Channel plugin interface with declared capabilities. Apple and Google moved onto it unchanged.
Test store: purchases, renewals, grace periods, refunds, revocations, scenario simulation and time travel, all with environment: "test".
SDK 0.2.0: testStore mode that works in Expo Go; kasskeep-web.js adds configureTestStore and mode().
CLI masks the public key by default and never prints secret keys outside create and rotate-keys.

POST .../webhooks/test sends a signed test event and reports the response. New event type test.
App lookup by ios_bundle_id and android_package.
GET .../credentials returns summaries with fingerprints.

Multi-tenancy with row-level security and per-tenant encryption keys.
Accounts with roles, mandatory TOTP, invitations, ownership transfer, account deletion and audit logs.
Admin API under /v1/admin; the CLI uses personal access tokens.

App Store: StoreKit 2 verification, Server Notifications V2 and the Server API.
Google Play: Play Developer API verification, acknowledgement and consumption, voided purchases and RTDN.
Signed webhooks with retries, and GET /v1/events.
SDK @kasskeep/react-native with the WebView bridge and kasskeep-web.js.