Backend Architecture for Play Billing

The client is not trustworthy. Signatures can be forged, APKs can be modified, and local purchase data can be faked. Your backend must treat the purchase token as an opaque value to verify with Google. This skill walks you through the verification pipeline, from receiving a token to persisting entitlement state.

Phase 1: Scope

Confirm the following before you write code.

• You know which product types you sell (subscriptions, consumables, non consumables). The API endpoint differs per type.
• You have a user identity model. Each purchase token must map to one user account on your server.
• You have (or can add) a database for purchase records. The schema uses purchaseToken as the primary key.
• You have a plan for acknowledgement within 3 days. Unacknowledged purchases auto refund.
• You have a Google Play Console account and can access Setup > API access.

If any of these are missing, stop and resolve before continuing.

Phase 2: Plan

2.1 Configure Google Play Developer API access