1. @robot_media

2. Android In-App Billing
Demystified
Hermés Piqué
@hpique

3. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library

4. Freemium

5. Digital goods

6. Digital content

7. Subscriptions

8. Virtual currency

9. IAB for the user...
• Faster
• Simpler
• Contextual
• “Harmless”
• “Inexpensive”

10. IAB generates
more sales

11. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library

12. Options
• Android Market In-App Billing
• PayPal Mobile Payments Library
• Others
• Any web payment processor
• Custom implementation

13. Android Market IAB
• Android Market only
• 30% of the sale price
• Android 1.6 upwards
• Only digital goods

14. PayPal Mobile Payments
• Starts at 2.9% of
the sale price +
transaction fee
• Android 1.5
upwards
• Physical goods
allowed

15. Others
• Paythru
• Movend
• Open Payments
• ...

16. “All fees received by Developers for Products
distributed via the Market must be processed by the
Market's Payment Processor.”
http://www.android.com/us/developer-distribution-agreement.html

17. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library

18. Purchase type
• Managed per user account
• premium, digital content, unique virtual goods
• Unmanaged
• subscriptions, virtual currency, unlimited virtual
goods

19. Pre-requisites
• Services
• AIDL
• BroadcastReceiver
• PendingIntent

20. Overview
app
Android
IAB Market
requests
Server

21. Messaging sequence

22. IAB requests
• CHECK_BILLING_SUPPORTED
• REQUEST_PURCHASE
• GET_PURCHASE_INFORMATION
• CONFIRM_NOTIFICATIONS
• RESTORE_TRANSACTIONS

23. IAB requests
• MarketBillingService interface defined in an
Android Interface Definition Language file
(IMarketBillingService.aidl)
• IAB requests sent by single IPC method
(sendBillingRequest()) of the interface
• Request type and parameters are sent as a
Bundle

24. Binding to
MarketBillingService
try {
boolean bindResult = mContext.bindService(
new Intent("com.android.vending.billing.MarketBillingService.BIND"), this,
Context.BIND_AUTO_CREATE);
if (bindResult) {
Log.i(TAG, "Service bind successful.");
} else {
Log.e(TAG, "Could not bind to the MarketBillingService.");
}
} catch (SecurityException e) {
Log.e(TAG, "Security exception: " + e);
}
public void onServiceConnected(ComponentName name, IBinder service) {
Log.i(TAG, "MarketBillingService connected.");
mService = IMarketBillingService.Stub.asInterface(service);
}

25. Request bundle
parameters
• Shared
• BILLING_REQUEST: request type
• API_VERSION: 1
• PACKAGE_NAME: app package
• Specific
• ITEM_ID, NONCE, NOTIFY_ID,
DEVELOPER_PAYLOAD

26. Request bundle
protected Bundle makeRequestBundle(String method) {
Bundle request = new Bundle();
request.putString(BILLING_REQUEST, method);
request.putInt(API_VERSION, 1);
request.putString(PACKAGE_NAME, getPackageName());
return request;
}

27. Making a request
Bundle request = makeRequestBundle("REQUEST_PURCHASE");
request.putString(ITEM_ID, mProductId);
Bundle response = mService.sendBillingRequest(request);

28. IAB responses
• The IAB service responds to every request
with a synchronous response
• Followed by 0..N asynchronous responses
depending of the request type

29. Synchronous responses
• RESPONSE_CODE: status information and
error information about a request
• REQUEST_ID: used to match
asynchronous responses with requests
• PURCHASE_INTENT: PendingIntent, which
you use to launch the checkout activity.
REQUEST_PURCHASE only.

30. Asynchronous
responses
• Broadcast intents:
• RESPONSE_CODE
• IN_APP_NOTIFY
• PURCHASE_STATE_CHANGED

31. Receiving async
responses
public void onReceive(Context context, Intent intent) {
String action = intent.getAction();
if (ACTION_PURCHASE_STATE_CHANGED.equals(action)) {
String signedData = intent.getStringExtra(INAPP_SIGNED_DATA);
String signature = intent.getStringExtra(INAPP_SIGNATURE);
// Do something with the signedData and the signature.
} else if (ACTION_NOTIFY.equals(action)) {
String notifyId = intent.getStringExtra(NOTIFICATION_ID);
// Do something with the notifyId.
} else if (ACTION_RESPONSE_CODE.equals(action)) {
long requestId = intent.getLongExtra(INAPP_REQUEST_ID, -1);
int responseCodeIndex = intent.getIntExtra(INAPP_RESPONSE_CODE,
ResponseCode.RESULT_ERROR.ordinal());
// Do something with the requestId and the responseCodeIndex.
} else {
Log.w(TAG, "unexpected action: " + action);
}
}

32. Check Billing
Supported

33. Check Billing
Supported
Parameters Basic
Sync response keys RESPONSE_CODE
RESULT_OK
RESULT_BILLING_UNAVAILABLE
Response codes
RESULT_ERROR
RESULT_DEVELOPER_ERROR
Async response RESPONSE_CODE

34. Request Purchase

35. Request Purchase
Basic
Parameters ITEM_ID
DEVELOPER_PAYLOAD
RESPONSE_CODE
Sync response keys PURCHASE_INTENT
REQUEST_ID
RESULT_OK
Response codes RESULT_ERROR
RESULT_DEVELOPER_ERROR
RESPONSE_CODE
Async response
IN_APP_NOTIFY

36. Get Purchase
Information
Basic
Parameters NONCE
NOTIFY_IDS
RESPONSE_CODE
Sync response keys
REQUEST_ID
RESULT_OK
Response codes RESULT_ERROR
RESULT_DEVELOPER_ERROR
RESPONSE_CODE
Async response
PURCHASE_STATE_CHANGED

37. Purchase State
Changed JSON
{ "nonce" : 1836535032137741465,
"orders" :
{ "notificationId" : "android.test.purchased",
"orderId" : "transactionId.android.test.purchased",
"packageName" : "com.example.dungeons",
"productId" : "android.test.purchased",
"developerPayload" : "bGoa+V7g/yqDXvKRqq+JTFn4uQZbPiQ",
"purchaseTime" : 1290114783411,
"purchaseState" : 0 }
}

38. Purchase States
• Purchased (0)
• Canceled (1)
• Refunded (2)

39. Confirm Notifications
Basic
Parameters NONCE
NOTIFY_IDS
RESPONSE_CODE
Sync response keys
REQUEST_ID
RESULT_OK
Response codes RESULT_ERROR
RESULT_DEVELOPER_ERROR
Async response RESPONSE_CODE

40. Unsolicited In-App
Notify
• Purchase when app is running in
various devices
• Refunds

41. Unsolicited In-App
Notify

42. Restore Transactions

43. Restore Transactions
Basic
Parameters
NONCE
RESPONSE_CODE
Sync response keys
REQUEST_ID
RESULT_OK
Response codes RESULT_ERROR
RESULT_DEVELOPER_ERROR
RESPONSE_CODE
Async response
PURCHASE_STATE_CHANGED

44. Security Controls
• Signed purchase data
• In-App Notify Nonces

45. Purchase State
Changed Extras
• inapp_signed_data: Signed JSON
string (unencrypted)
• inapp_signature: Use the Android
Market public key to validate

48. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library

49. requestPurchase("com.example.item");

50. Android Billing Library
tiny.cc/android-billing
• On github
• Beta but...
• “Better than starting from scratch”

51. Features
• Full Android IAB Service
implementation
• Auto-confirmations
• Obfuscated purchases database
• Implements security best-practices
• Half-decent unit testing coverage

52. Overview

53. AndroidManifest.xml
<!-- Add this permission to your manifest -->
<uses-permission android:name="com.android.vending.BILLING" />
<application>
<!-- Add this service and receiver to your application -->
<service android:name="net.robotmedia.billing.BillingService" />
<receiver android:name="net.robotmedia.billing.BillingReceiver">
<intent-filter>
<action android:name="com.android.vending.billing.IN_APP_NOTIFY" />
<action android:name="com.android.vending.billing.RESPONSE_CODE" />
<action
android:name="com.android.vending.billing.PURCHASE_STATE_CHANGED" />
</intent-filter>
</receiver>
</application>

54. Set Configuration
public void onCreate() {
super.onCreate();
BillingController.setDebug(true);
BillingController.setConfiguration(new BillingController.IConfiguration() {
@Override
public byte[] getObfuscationSalt() {
return new byte[] {41, -90, -116, -41, 66, -53, 122, -110, -127, -96, -88, 77, 127
}
@Override
public String getPublicKey() {
return "your public key here";
}
});
}

55. Check Billing
Supported
@Override
public void onCreate(Bundle savedInstanceState) {
// ...
BillingController.registerObserver(mBillingObserver);
BillingController.checkBillingSupported(this);
// ...
}
public void onBillingChecked(boolean supported) {
if (!supported) {
showDialog(DIALOG_BILLING_NOT_SUPPORTED_ID);
}
}

56. Request Purchase
BillingController.requestPurchase(this, productId, true /*confirm*/);
@Override
public void onPurchaseIntent(String itemId, PendingIntent purchaseIntent) {
BillingController.startPurchaseIntent(activity, purchaseIntent, null);
}
@Override
public void onRequestPurchaseResponse(String itemId, ResponseCode response) {
}
@Override
public void onPurchaseStateChanged(String itemId, PurchaseState state) {
}

57. Restore Transactions
if (!mBillingObserver.isTransactionsRestored()) {
BillingController.restoreTransactions(this);
Toast.makeText(this, R.string.restoring_transactions,
Toast.LENGTH_LONG).show();
}
@Override
public void onTransactionsRestored() {
final SharedPreferences preferences =
PreferenceManager.getDefaultSharedPreferences(activity);
final Editor editor = preferences.edit();
editor.putBoolean(KEY_TRANSACTIONS_RESTORED, true);
editor.commit();
}

58. Suggested
implementation

59. Thanks!

60. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library
• Administering & Testing In-App Billing
• Security Best Practices

61. Purchase type
• Managed per user account
• premium, digital content, unique virtual goods
• Unmanaged
• subscriptions, virtual currency, unlimited virtual
goods

62. Managing In-App
Products

64. Public key

65. Reserved product ids
• android.test.purchased
• android.test.canceled
• android.test.refunded
• android.test.item_unavailable

66. Test purchase process

67. Signed test responses
Application ever Draft uploaded &
User
been published? unpublished?
* * Developer
Yes No Test user
Yes Yes *

68. Agenda
• In-App Billing Overview
• In-App Billing in Android
• Android Market Billing Service
• Android Billing Library
• Administering & Testing In-App Billing
• Security Best Practices

69. Best practices
• Random nonces
• Obfuscate purchase data
• Embedding public key
• Code obfuscation
• Server-side signature validation

70. Thanks!