I have an application which communicates with my backend and I want the backend to accept and respond only if the user bought the app via the play store and did not steal it. So the idea is:
- User buys the app via playstore
- app communicates via server and sends the gmail address of the user who uses the app
- server asks Purchase Status API if the user bought the app with the passed gmail account
This way it would not be possible to crack the application in any way, if the user did not buy it via the play store the server can easily detect this and there is no way to fake it
the problem is it seems to me that the purchase status api is only for in app purchases and not for checking if the app was bought via the playserver itself.. Does anyone have infos how I can do what I want to do? Did no one before me had this problem?
According to the documentation, if you're providing subscription-style services, the Purchase API provides the ability to verify the token (not the user's GMail ID) provided to the device on purchase. The token is securely embedded (more or less) and is, we assume, difficult to find and copy to another device.
If you're worried about piracy of your app, look here:
来源：https://stackoverflow.com/questions/19165994/can-i-use-purchase-status-api-to-validate-if-app-was-bought-via-play-store