Overview

If you use in-app purchases on Google Play, there is some configuration the server needs to validate purchases. This should be done as part of step 9. Configure the Servers for Real Purchase Validation of the basic IAP guide.

Minimal Setup

Configure at least the Android application's package name and public key.

Options.base.yaml

GooglePlayStore:
    # Google Play / Android configuration, needed to validate Google Play IAPs:
    # Application id on Android.
    AndroidPackageName: com.examplecompany.examplegame
    # Base64-encoded public key for the Google Play app.
    # Get this from the Google Play console.
    GooglePlayPublicKey: "MIIBI..."

GooglePlayPublicKey is found in Google Play Console: "View app" -> "Monetize with Play" -> "Monetization setup". It is the base64-encoded RSA public key under "Licensing".

Android Publisher Service Account

We also strongly recommend configuring an Android Publisher service account.

• It allows the server to confirm purchases to Google. Without this, only the client will confirm purchases, which is less reliable.
• It is required for Auto-Renewing Subscriptions.
• It allows the game to detect Sandbox Purchases.
• It allows the server to detect refunds at the time of purchase validation, and allows issuing Google Play Refunds via the LiveOps Dashboard.

First, follow Google Play’s developer API guide on setting up the service account. Make sure you give the service account the following permissions:

• “View financial data, orders, and cancellation survey responses.”
  • Note: This is under "Account permissions" rather than "App permissions". "App permissions" contains a permission called simply "View financial data", but that is not the correct one for this purpose.
• “Manage orders and subscriptions.”

💡 Note

It can take as long as 24 hours for the account permissions to take effect. You can make dummy modifications to your In-App Products in Google Play to shorten this delay; see this Stack Overflow thread.

Upon creating the service account, you should get a .json file with the account’s credentials. Store it as a secret in the correct environment:

# Below, replace my-environment with the environment ID (e.g. your production environment).
# Your local file service-account.json must contain the service account credentials.
metaplay secrets create my-environment user-android-publisher-api-service-account --from-file=value=service-account.json

Update the relevant Options.*.yaml file accordingly:

Options.production.yaml (or some other environment)

GooglePlayStore:
  # ... pre-existing values omitted from this snippet ...
  EnableAndroidPublisherApi: true
  AndroidPublisherApiServiceAccountPath: "kube-secret://user-android-publisher-api-service-account#value"

If you need to test the secret on your local machine, have it in a temporary file and use file://your/path/to/service-account.json instead of kube-secret://.... You should not commit it, as it's best to avoid putting secrets in a code repository.

With the service account now configured, you should test that Google Play purchases still work. If the service account has been given insufficient permissions or otherwise misconfigured, Google Play purchase validation will not complete.