The Android docs say that its meant for \"supplemental information about an order\" but at the same time it also says not to use this to send \"actual data or content\".
The docs provide a real example:
A developer-specified string that can be specified when you make a REQUEST_PURCHASE request. This field is returned in the JSON string that contains transaction information for an order. You can use this key to send supplemental information with an order. For example, you can use this key to send index keys with an order, which is useful if you are using a database to store purchase information. We recommend that you do not use this key to send data or content.
You can use this field to identify the item the user is purchasing. When you issue a REQUEST_PURCHASE
request you can put additional information using DEVELOPER_PAYLOAD
. When you get the response from PURCHASE_STATE_CHANGED
you'll get this info back in the developerPayload
field, so you can identify the order.
This field is limited to 256 chars and it's unencrypted (you can verify the signature though), it's not meant to store actual content.