Verify Purchase Data without Google Server Authentication

[SharyRajpoot]

I have an android app and inside it, there's some consumables item for users to purchase, and then that purchase data which is returned by Google In-App-Billing is submitted to backend server and then the server checks the validity of data....like is this purchase is authentic mean real.
Previously I was using Node.Js for this purpose and app backend.
But now,
I have moved the backend to PHP Laravel and looking for the same solution as what Node.Js does for me.

In other words, if I say this node js is just taking a Google In-App-Billing e.g: data and signature and uses GOOGLE_PLAY_PUBLIC_KEY to verify the purchase is real or not WITHOUT any other server interaction.
for reference to node js library: iab-verifier

Now your library provides the same features as node js but using a google server.
here what I want to just validate purchase data against using GOOGLE_PLAY_PUBLIC_KEY for purchase validations.

Does your Laravel Lib. provides any methods like Node.Js iab_verifier?

[imdhemy]

Hi @SharyRajpoot, AlsalamAlykom,

Unfortunately, the only allowed authentication method till now is Authentication as a service account.

It's pretty easy to create the JSON file, just follow the steps mentioned here.

[SharyRajpoot]

Yes, I know but here I am talking about doing authentication using our owed server.
When we make a purchased with google IAB, Google sends us a signature and a purchased data as a receipt. Which is generated using a PUBLIC_KEY. So, here google also provide us we developer a GOOGLE_PLAY_PUBLIC_KEY which is used by Google to generate this data for us and we can use this to authenticate a verification on our servers as well.

I have already done this in Node.Js API using iab-verifier but I didn't find any way to do it in laravel application.
until then I found your library but it's using a google server for authentication...

[SharyRajpoot]

Suppose if my GOOGLE_APPLICATION_CREDENTIALS are present inside the Laravel storage or public folder, then how should I provide its path in .env file so your lib. can know about it.

[SharyRajpoot]

Any example of the path which you are talking about...
e.g: local and live server

[imdhemy]

@SharyRajpoot
Something like:

/etc/var/www/path/to/file.json

[SharyRajpoot]

supposed if it's in the storage folder and inside the app then what will be the path OR supposed if it's in the public folder then what will be the path?
Also, I am currently running it locally and can you also guide me on this how and wherein the code for this path is exactly used by the app so I could make it more dynamic over the absolute path...if possible

[SharyRajpoot]

any suggestion?

[dev-rizwanqureshi]

@SharyRajpoot you can use like this

$credentialsPath = storage_path('app/google_application_credentials.json');
putenv("GOOGLE_APPLICATION_CREDENTIALS=$credentialsPath");

[dev-rizwanqureshi]

Hi @imdhemy I am facing issues retrieving/verifying the Google Play receipt data,

$subscriptionReceipt = Subscription::googlePlay()->receiptData($subscription->receipt_data)->verifyReceipt();

It requires a password. Can you help me with this?

Thankyou

[dev-rizwanqureshi]

Also if I want to verify like this then how can I get $itemId and $purchaseToken? Right now I have only receipt_data to verify.

$subscriptionReceipt = Subscription::googlePlay()->id($itemId)->token($purchaseToken)->get();

[imdhemy]

Hi @dev-rizwanqureshi
You can consult the documentation for guides.

how can I get $itemId and $purchaseToken

The $itemId is the product or the subscription ID you set on Google Play Console. The $purchaseToken is received on the Mobile Application once the purchase is completed, then the application needs to send this token to the backend.

[dev-rizwanqureshi]

Thankyou @imdhemy for the response