diff --git a/docs/html/guide/guide_toc.cs b/docs/html/guide/guide_toc.cs index 24e4648bcb48f..a898545c3d701 100644 --- a/docs/html/guide/guide_toc.cs +++ b/docs/html/guide/guide_toc.cs @@ -364,7 +364,7 @@
  • In-app Billing - new! + updated

    Using these techniques can help reduce the attack surface of your application and help minimize attacks that can compromise your in-app billing implementation.

    -

    Note: If you use Proguard to obfuscate your code, you must add the following line to your Proguard configuration file:

    +

    Note: If you use Proguard to obfuscate your code, you must add the following line to your Proguard configuration file:

    -keep class com.android.vending.billing.**

    diff --git a/docs/html/guide/market/billing/billing_integrate.jd b/docs/html/guide/market/billing/billing_integrate.jd index 0cac2eb9d80e1..d02768682f243 100755 --- a/docs/html/guide/market/billing/billing_integrate.jd +++ b/docs/html/guide/market/billing/billing_integrate.jd @@ -3,12 +3,6 @@ parent.title=In-app Billing parent.link=index.html @jd:body - -

    In this document

    @@ -16,7 +10,7 @@ parent.link=index.html
  • Downloading the Sample Application
  • Adding the AIDL file to your project
  • Updating Your Application's Manifest
    • -
  • Creating a Service
    • +
  • Creating a Service
  • Creating a BroadcastReceiver
  • Creating a security processing component
  • Modifying Your Application Code
    • @@ -37,10 +31,10 @@ parent.link=index.html
    -

    This documentation provides an early look at the Android Market In-app Billing service. The documentation may change without notice.

    +

    During the testing phase of the in-app billing release you cannot publish applications that implement in-app billing. You can only upload in-app billing applications as draft applications. For more information, see About this Release

    -

    The Android Market In-app Billing service provides a straightforward, simple interface for sending in-app billing requests and managing in-app billing transactions using Android Market. This document helps you implement in-app billing by stepping through the primary implementation tasks, using the in-app billing sample application as an example.

    +

    The Android Market in-app billing service provides a straightforward, simple interface for sending in-app billing requests and managing in-app billing transactions using Android Market. This document helps you implement in-app billing by stepping through the primary implementation tasks, using the in-app billing sample application as an example.

    Before you implement in-app billing in your own application, be sure that you read Overview of In-app Billing and Security and Design. These documents provide background information that will make it easier for you to implement in-app billing.

    @@ -67,7 +61,7 @@ parent.link=index.html
  • Creating a user interface that lets users select items for purchase.
    • -

    The sample application includes an application file (Dungeons.java), the AIDL file for the MarketBillingService (IMarketBillingService.aidl), and several classes that demonstrate in-app billing messaging. It also includes a class that demonstrates basic security tasks, such as signature verification.

    +

    The sample application includes an application file (Dungeons.java), the AIDL file for the MarketBillingService (IMarketBillingService.aidl), and several classes that demonstrate in-app billing messaging. It also includes a class that demonstrates basic security tasks, such as signature verification.

    Table 1 lists the source files that are included with the sample application.

    Table 1. @@ -86,7 +80,7 @@ In-app billing sample application source files.

    Dungeons.java -Sample application file that provides a UI for making purchases and diplaying purchase history. +Sample application file that provides a UI for making purchases and displaying purchase history. @@ -130,19 +124,101 @@ In-app billing sample application source files.

    -

    The in-app billing sample application is available as a downloadable component of the Android SDK. To download the sample application component, launch the Android SDK and AVD Manager and then select the "Market Billing package, revision 1" component (see figure 1), and click Install Selected to begin the download.

    +

    The in-app billing sample application is available as a downloadable component of the Android SDK. To download the sample application component, launch the Android SDK and AVD Manager and then select the "Google Market Billing package" component (see figure 1), and click Install Selected to begin the download.

    - -
    Figure 1. The Google Market -Billing package contains the sample application and the AIDL file.
    -
    + +

    + Figure 1. The Google Market Billing package contains the sample application and the AIDL file. +

    When the download is complete, the Android SDK and AVD Manager saves the component into the following directory:

    <sdk>/google-market_billing/

    +

    If you want to see an end-to-end demonstration of in-app billing before you integrate in-app billing into your own application, you can build and run the sample application. Building and running the sample application involves three tasks:

    + +

    + +

    Note: Building and running the sample application is necessary only if you want to see a demonstration of in-app billing. If you do not want to run the sample application, you can skip to the next section, Adding the AIDL file to your project.

    + +

    Configuring and building the sample application

    + +

    Before you can run the sample application, you need to configure it and build it by doing the following:

    + +
      +
    1. Add your Android Market public key to the sample application code. +

      This enables the application to verify the signature of the transaction information that is returned from Android Market. To add your public key to the sample application code, do the following:

      +
        +
      1. Log in to your Android Market publisher account.
        2. +
      2. On the upper left part of the page, under your name, click Edit Profile.
        3. +
      3. On the Edit Profile page, scroll down to the Licensing & In-app Billing panel.
        4. +
      4. Copy your public key.
        5. +
      5. Open src/com/example/dungeons/Security.java in the editor of your choice. +

        You can find this file in the sample application's project folder.

        +
        6. +
      6. Add your public key to the following line of code: +

        String base64EncodedPublicKey = "your public key here";

        +
        7. +
      7. Save the file.
        8. +
      +
      2. +
    2. Change the package name of the sample application. +

      The current package name is com.example.dungeons. Android Market does not let you upload applications with package names that contain com.example, so you must change the package name to something else.

      +
      3. +
    3. Build the sample application in release mode and sign it. +

      To learn how to build and sign applications, see Building and Running.

      +
      4. +
    + +

    Uploading the sample application

    + +

    After you build a release version of the sample application and sign it, you need to upload it as a draft to the Android Market publisher site. You also need to create a product list for the in-app items that are available for purchase in the sample application. The following instructions show you how to do this.

    +
      +
    1. Upload the release version of the sample application to Android Market. +

      Do not publish the sample application; leave it as an unpublished draft application. The sample application is for demonstration purposes only and should not be made publicly available on Android Market. To learn how to upload an application to Android Market, see Uploading applications.

      +
      2. +
    2. Create a product list for the sample application. +

      The sample application lets you purchase two items: a two-handed sword (sword_001) and a potion (potion_001). We recommend that you set up your product list so that sword_001 has a purchase type of "Managed per user account" and potion_001 has a purchase type of "Unmanaged" so you can see how these two purchase types behave. To learn how to set up a product list, see Creating a Product List.

      +

      Note: You must publish the items in your product list (sword_001 and potion_001) even though you are not publishing the sample application. Also, you must have a Google Checkout Merchant account to add items to the sample application's product list.

      +
      3. +
    + +

    Running the sample application

    + +

    You cannot run the sample application in the emulator. You must install the sample application onto a device to run it. To run the sample application, do the following:

    + +
      +
    1. Make sure you have at least one test account registered under your Android Market publisher account. +

      You cannot purchase items from yourself (Google Checkout prohibits this), so you need to create at least one test account that you can use to purchase items in the sample application. To learn how to set up a test account, see Setting up Test Accounts.

      +
      2. +
    2. Verify that your device is running a supported version of the Android Market application or the MyApps application. +

      If your device is running Android 3.0, in-app billing requires version 5.0.12 (or higher) of the MyApps application. If your device is running any other version of Android, in-app billing requires version 2.3.4 (or higher) of the Android Market application. To learn how to check the version of the Android Market application, see Updating Android Market.

      +
      3. +
    3. Install the application onto your device. +

      Even though you uploaded the application to Android Market, the application is not published, so you cannot download it from Android Market to a device. Instead, you must install the application onto your device. To learn how to install an application onto a device, see Running on a device.

      +
      4. +
    4. Make one of your test accounts the primary account on your device. +

      The primary account on your device must be one of the test accounts that you registered on the Android Market site. If the primary account on your device is not a test account, you must do a factory reset of the device and then sign in with one of your test accounts. To perform a factory reset, do the following:

      +
        +
      1. Open Settings on your device.
        2. +
      2. Touch Privacy.
        3. +
      3. Touch Factory data reset.
        4. +
      4. Touch Reset phone.
        5. +
      5. After the phone resets, be sure to sign in with one of your test accounts during the device setup process.
        6. +
      +
      5. +
    5. Run the application and purchase the sword or the potion. +

      When you use a test account to purchase items, the test account is billed through Google Checkout and your Google Checkout Merchant account receives a payout for the purchase. Therefore, you may want to refund purchases that are made with test accounts, otherwise the purchases will show up as actual payouts to your merchant account.

      +
    + +

    Note: Debug log messages are turned off by default in the sample application. You can turn them on by setting the variable DEBUG to true in the Consts.java file.

    +

    Adding the AIDL file to your project

    The sample application contains an Android Interface Definition Language (AIDL) file, which defines the interface to the Android Market in-app billing service MarketBillingService). When you add this file to your project, the Android build environment creates an interface file (IMarketBillingService.java). You can then use this interface to make billing requests by invoking IPC method calls.

    @@ -159,15 +235,15 @@ Billing package contains the sample application and the AIDL file.
  • Build your application.
    • -

    You should now find a generated interface file named IMarketBillingService.java in the gen folder of your project.

    +

    You should now find a generated interface file named IMarketBillingService.java in the gen folder of your project.

    Updating Your Application's Manifest

    In-app billing relies on the Android Market application, which handles all communication between your application and the Android Market server. To use the Android Market application, your application must request the proper permission. You can do this by adding the com.android.vending.BILLING permission to your AndroidManifest.xml file. If your application does not declare the in-app billing permission, but attempts to send billing requests, Android Market will refuse the requests and respond with a RESULT_DEVELOPER_ERROR response code.

    -

    In addition to the billing permission, you need to declare the {@link android.content.BroadcastReceiver} that you will use to receive asynchronous response messages (broadcast intents) from Android Market, and you need to declare the {@link android.app.Service} that you will use to bind with the IMarketBillingService and send messages to Android Market. You must also declare intent filters for the {@link android.content.BroadcastReceiver} so that the Android system knows how to handle broadcast intents that are sent from the Android Market application.

    +

    In addition to the billing permission, you need to declare the {@link android.content.BroadcastReceiver} that you will use to receive asynchronous response messages (broadcast intents) from Android Market, and you need to declare the {@link android.app.Service} that you will use to bind with the IMarketBillingService and send messages to Android Market. You must also declare intent filters for the {@link android.content.BroadcastReceiver} so that the Android system knows how to handle the broadcast intents that are sent from the Android Market application.

    -

    For example, here's how the in-app billing sample application declares the billing permission, the {@link android.content.BroadcastReceiver}, the {@link android.app.Service}, and the intent filters. In the sample application, BillingReceiver is the {@link android.content.BroadcastReceiver} that handles broadcast intents from the Android Market application and BillingService is the {@link android.app.Service} that sends requests to the Android Market application.

    +

    For example, here is how the in-app billing sample application declares the billing permission, the {@link android.content.BroadcastReceiver}, the {@link android.app.Service}, and the intent filters. In the sample application, BillingReceiver is the {@link android.content.BroadcastReceiver} that handles broadcast intents from the Android Market application and BillingService is the {@link android.app.Service} that sends requests to the Android Market application.

     <?xml version="1.0" encoding="utf-8"?>
@@ -236,7 +312,7 @@ try {
 }
    -

    After you bind to the service, you need to create a reference to the IMarketBillingService interface so you can make billing requests via IPC method calls. The following code shows you how to do this using the {@link android.content.ServiceConnection#onServiceConnected onServiceConnected()} callback method.

    +

    After you bind to the service, you need to create a reference to the IMarketBillingService interface so you can make billing requests via IPC method calls. The following code shows you how to do this using the {@link android.content.ServiceConnection#onServiceConnected onServiceConnected()} callback method.

     /**
@@ -265,7 +341,7 @@ try {
   
  • RESTORE_TRANSACTIONS—retrieves a user's transaction history for managed purchases.
    • 
 
 
-
    To make any of these billing requests, you first need to build an initial Bundle that contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The following code sample shows you how to create a helper method named makeRequestBundle() that does this.
    
+
    To make any of these billing requests, you first need to build an initial {@link android.os.Bundle} that contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The following code sample shows you how to create a helper method named makeRequestBundle() that does this.
    
 
 
     protected Bundle makeRequestBundle(String method) {
@@ -296,13 +372,17 @@ protected Bundle makeRequestBundle(String method) {
 
    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The request returns a synchronous {@link android.os.Bundle} response, which contains only a single key: RESPONSE_CODE. The RESPONSE_CODE key can have the following values:
    
 
 
 
    The CHECK_BILLING_SUPPORTED request does not trigger any asynchronous responses (broadcast intents).
    
 
+
    We recommend that you invoke the CHECK_BILLING_SUPPORTED request within a RemoteException block. When your code throws a RemoteException it indicates that the remote method call failed, which means that the Android Market application is out of date and needs to be updated. In this case, you can provide users with an error message that contains a link to the Updating Android Market Help topic.
    
+
+
    The sample application demonstrates how you can handle this error condition (see DIALOG_CANNOT_CONNECT_ID in Dungeons.java).
    
+
 
    Making a purchase request (REQUEST_PURCHASE)
    
 
 
    To make a purchase request you must do the following:
    
@@ -336,7 +416,7 @@ protected Bundle makeRequestBundle(String method) {
 
 
    Launching the pending intent
    
 
-
    How you use the pending intent depends on which version of Android a device is running. On Android 1.6, you must use the pending intent to launch the checkout UI in its own separate task instead of your application's activity stack. On Android 2.0 and higher, you can use the pending intent to launch the checkout UI on your application's activity stack. The following code shows you how to do this. You can find this code in the PurchaseObserver.java file in the sample application.
     
+
    How you use the pending intent depends on which version of Android a device is running. On Android 1.6, you must use the pending intent to launch the checkout UI in its own separate task instead of your application's activity stack. On Android 2.0 and higher, you can use the pending intent to launch the checkout UI on your application's activity stack. The following code shows you how to do this. You can find this code in the PurchaseObserver.java file in the sample application.
    
 
 
     void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) {
@@ -369,17 +449,17 @@ void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) {
 }
 
    
 
-
    You must launch the pending intent from an activity context and not an application context.
    
+
    Important: You must launch the pending intent from an activity context and not an application context. Also, you cannot use the singleTop launch mode to launch the pending intent. If you do either of these, the Android system will not attach the pending intent to your application process. Instead, it will bring Android Market to the foreground, disrupting your application.
    
 
 
    Handling broadcast intents
    
 
-
    A REQUEST_PURCHASE request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends an ACTION_RESPONSE_CODE broadcast intent, which provides error information about the request. Next, if the request was successful, the Android Market application sends an ACTION_NOTIFY broadcast intent. This message contains a notification ID, which you can use to retrieve the transaction details for the REQUEST_PURCHASE request.
    
+
    A REQUEST_PURCHASE request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends a RESPONSE_CODE broadcast intent, which provides error information about the request. Next, if the request was successful, the Android Market application sends an IN_APP_NOTIFY broadcast intent. This message contains a notification ID, which you can use to retrieve the transaction details for the REQUEST_PURCHASE request.
    
 
-
    Keep in mind, the Android Market application also sends an ACTION_NOTIFY for refunds. For more information, see Handling ACTION_NOTIFY messages.
     
+
    Keep in mind, the Android Market application also sends an IN_APP_NOTIFY for refunds. For more information, see Handling IN_APP_NOTIFY messages.
    
 
 
    Retrieving transaction information for a purchase or refund (GET_PURCHASE_INFORMATION)
    
 
-
    You retrieve transaction information in response to an ACTION_NOTIFY broadcast intent. The ACTION_NOTIFY message contains a notification ID, which you can use to retrieve transaction information.
    
+
    You retrieve transaction information in response to an IN_APP_NOTIFY broadcast intent. The IN_APP_NOTIFY message contains a notification ID, which you can use to retrieve transaction information.
    
 
 
    To retrieve transaction information for a purchase or refund you must specify five keys in the request {@link android.os.Bundle}. The following code sample shows how to set these keys and make the request. In the sample, mService is an instance of the MarketBillingService interface.
    
 
@@ -394,11 +474,11 @@ void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) {
   // Do something with this response.
 }
 
    
-
    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional keys are then added to the bundle prior to invoking the sendBillingRequest() method. The REQUEST_NONCE key contains a cryptographically secure nonce (number used once) that you must generate. The Android Market application returns this nonce with the ACTION_PURCHASE_STATE_CHANGED broadcast intent so you can verify the integrity of the transaction information. The NOTIFY_IDS key contains an array of notification IDs, which you received in the ACTION_NOTIFY broadcast intent.
    
+
    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional keys are then added to the bundle prior to invoking the sendBillingRequest() method. The REQUEST_NONCE key contains a cryptographically secure nonce (number used once) that you must generate. The Android Market application returns this nonce with the PURCHASE_STATE_CHANGED broadcast intent so you can verify the integrity of the transaction information. The NOTIFY_IDS key contains an array of notification IDs, which you received in the IN_APP_NOTIFY broadcast intent.
    
 
 
    The request returns a synchronous {@link android.os.Bundle} response, which contains two keys: RESPONSE_CODE and REQUEST_ID. The RESPONSE_CODE key provides you with the status of the request and the REQUEST_ID key provides you with a unique request identifier for the request.
    
 
-
    A GET_PURCHASE_INFORMATION request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends an ACTION_RESPONSE_CODE broadcast intent, which provides status and error information about the request. Next, if the request was successful, the Android Market application sends an ACTION_PURCHASE_STATE_CHANGED broadcast intent. This message contains detailed transaction information. The transaction information is contained in a signed JSON string (unencrypted). The message includes the signature so you can verify the integrity of the signed string.
    
+
    A GET_PURCHASE_INFORMATION request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends a RESPONSE_CODE broadcast intent, which provides status and error information about the request. Next, if the request was successful, the Android Market application sends a PURCHASE_STATE_CHANGED broadcast intent. This message contains detailed transaction information. The transaction information is contained in a signed JSON string (unencrypted). The message includes the signature so you can verify the integrity of the signed string.
    
 
 
    Acknowledging transaction information (CONFIRM_NOTIFICATIONS)
    
 
@@ -414,11 +494,13 @@ void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) {
   // Do something with this response.
 }
    -

    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional NOTIFY_IDS key is then added to the bundle prior to invoking the sendBillingRequest() method. The NOTIFY_IDS key contains an array of notification IDs, which you received in an ACTION_NOTIFY broadcast intent and also used in a GET_PURCHASE_INFORMATION request.

    +

    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional NOTIFY_IDS key is then added to the bundle prior to invoking the sendBillingRequest() method. The NOTIFY_IDS key contains an array of notification IDs, which you received in an IN_APP_NOTIFY broadcast intent and also used in a GET_PURCHASE_INFORMATION request.

    The request returns a synchronous {@link android.os.Bundle} response, which contains two keys: RESPONSE_CODE and REQUEST_ID. The RESPONSE_CODE key provides you with the status of the request and the REQUEST_ID key provides you with a unique request identifier for the request.

    -

    A CONFIRM_NOTIFICATIONS request triggers a single asynchronous response—an ACTION_RESPONSE_CODE broadcast intent. This broadcast intent provides status and error information about the request.

    +

    A CONFIRM_NOTIFICATIONS request triggers a single asynchronous response—a RESPONSE_CODE broadcast intent. This broadcast intent provides status and error information about the request.

    + +

    Note: As a best practice, you should not send a CONFIRM_NOTIFICATIONS request for a purchased item until you have delivered the item to the user. This way, if your application crashes or something else prevents your application from delivering the product, your application will still receive an IN_APP_NOTIFY broadcast intent from Android Market indicating that you need to deliver the product.

    Restoring transaction information (RESTORE_TRANSACTIONS)

    @@ -434,29 +516,29 @@ void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) { // Do something with this response. } -

    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional REQUEST_NONCE key is then added to the bundle prior to invoking the sendBillingRequest() method. The REQUEST_NONCE key contains a cryptographically secure nonce (number used once) that you must generate. The Android Market application returns this nonce with the transactions information contained in the ACTION_PURCHASE_STATE_CHANGED broadcast intent so you can verify the integrity of the transaction information.

    +

    The makeRequestBundle() method constructs an initial Bundle, which contains the three keys that are required for all requests: BILLING_REQUEST, API_VERSION, and PACKAGE_NAME. The additional REQUEST_NONCE key is then added to the bundle prior to invoking the sendBillingRequest() method. The REQUEST_NONCE key contains a cryptographically secure nonce (number used once) that you must generate. The Android Market application returns this nonce with the transactions information contained in the PURCHASE_STATE_CHANGED broadcast intent so you can verify the integrity of the transaction information.

    The request returns a synchronous {@link android.os.Bundle} response, which contains two keys: RESPONSE_CODE and REQUEST_ID. The RESPONSE_CODE key provides you with the status of the request and the REQUEST_ID key provides you with a unique request identifier for the request.

    -

    A RESTORE_TRANSACTIONS request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends an ACTION_RESPONSE_CODE broadcast intent, which provides status and error information about the request. Next, if the request was successful, the Android Market application sends an ACTION_PURCHASE_STATE_CHANGED broadcast intent. This message contains the detailed transaction information. The transaction information is contained in a signed JSON string (unencrypted). The message includes the signature so you can verify the integrity of the signed string.

    +

    A RESTORE_TRANSACTIONS request also triggers two asynchronous responses (broadcast intents). First, the Android Market application sends a RESPONSE_CODE broadcast intent, which provides status and error information about the request. Next, if the request was successful, the Android Market application sends a PURCHASE_STATE_CHANGED broadcast intent. This message contains the detailed transaction information. The transaction information is contained in a signed JSON string (unencrypted). The message includes the signature so you can verify the integrity of the signed string.

    Other service tasks

    -

    You may also want your {@link android.app.Service} to receive intent messages from your {@link android.content.BroadcastReceiver}. You can use these intent messages to convey the information that was sent asynchronously from the Android Market application to your {@link android.content.BroadcastReceiver}. To see an example of how you can send and receive these intent messages, see the BillingReceiver.java and BillingService.java files in the sample application. You can use these samples as a basis for your own implementation. However, if you use any of the code from the sample application, be sure you follow the guidelines in Security and Design.

    +

    You may also want your {@link android.app.Service} to receive intent messages from your {@link android.content.BroadcastReceiver}. You can use these intent messages to convey the information that was sent asynchronously from the Android Market application to your {@link android.content.BroadcastReceiver}. To see an example of how you can send and receive these intent messages, see the BillingReceiver.java and BillingService.java files in the sample application. You can use these samples as a basis for your own implementation. However, if you use any of the code from the sample application, be sure you follow the guidelines in Security and Design.

    Creating a BroadcastReceiver

    The Android Market application uses broadcast intents to send asynchronous billing responses to your application. To receive these intent messages, you need to create a {@link android.content.BroadcastReceiver} that can handle the following intents:

    @@ -473,28 +555,28 @@ void startBuyPageActivity(PendingIntent pendingIntent, Intent intent) { Description - ACTION_RESPONSE_CODE - INAPP_REQUEST_ID + com.android.vending.billing.RESPONSE_CODE + request_id A long representing a request ID. A request ID identifies a specific billing request and is returned by Android Market at the time a request is made. - ACTION_RESPONSE_CODE - INAPP_RESPONSE_CODE + com.android.vending.billing.RESPONSE_CODE + response_code An int representing the actual Android Market server response code. - ACTION_NOTIFY - NOTIFICATION_ID + com.android.vending.billing.IN_APP_NOTIFY + notification_id A String representing the notification ID for a given purchase state change. Android Market notifies you when there is a purchase state change and the notification includes a unique notification ID. To get the details of the purchase state change, you send the notification ID with the GET_PURCHASE_INFORMATION request. - ACTION_PURCHASE_STATE_CHANGED - INAPP_SIGNED_DATA + com.android.vending.billing.PURCHASE_STATE_CHANGED + inapp_signed_data A String representing the signed JSON string. The JSON string contains information about the billing transaction, such as order number, amount, and the item that was purchased or refunded. - ACTION_PURCHASE_STATE_CHANGED - INAPP_SIGNATURE + com.android.vending.billing.PURCHASE_STATE_CHANGED + inapp_signature A String representing the signature of the JSON string. @@ -547,17 +629,17 @@ public class BillingReceiver extends BroadcastReceiver { } -

    In addition to receiving broadcast intents from the Android Market application, your {@link android.content.BroadcastReceiver} must handle the information it received in the broadcast intents. Usually, your {@link android.content.BroadcastReceiver} does this by sending the information to a local service (discussed in the next section). The BillingReceiver.java file in the sample application shows you how to do this. You can use this sample as a basis for your own {@link android.content.BroadcastReceiver}. However, if you use any of the code from the sample application, be sure you follow the guidelines that are discussed in Security and Design .

    +

    In addition to receiving broadcast intents from the Android Market application, your {@link android.content.BroadcastReceiver} must handle the information it received in the broadcast intents. Usually, your {@link android.content.BroadcastReceiver} does this by sending the information to a local service (discussed in the next section). The BillingReceiver.java file in the sample application shows you how to do this. You can use this sample as a basis for your own {@link android.content.BroadcastReceiver}. However, if you use any of the code from the sample application, be sure you follow the guidelines that are discussed in Security and Design .

    Verifying Signatures and Nonces

    -

    The in-app billing service uses two mechanisms to help verify the integrity of the transaction information you receive from Android Market: nonces and signatures. A nonce (number used once) is a cryptographically secure number that your application generates and sends with every GET_PURCHASE_INFORMATION and RESTORE_TRANSACTIONS request. The nonce is returned with the ACTION_PURCHASE_STATE_CHANGED broadcast intent, enabling you to verify that any given ACTION_PURCHASE_STATE_CHANGED response corresponds to an actual request that you made. Every ACTION_PURCHASE_STATE_CHANGED broadcast intent also includes a signed JSON string and a signature, which you can use to verify the integrity of the response.

    +

    The in-app billing service uses two mechanisms to help verify the integrity of the transaction information you receive from Android Market: nonces and signatures. A nonce (number used once) is a cryptographically secure number that your application generates and sends with every GET_PURCHASE_INFORMATION and RESTORE_TRANSACTIONS request. The nonce is returned with the PURCHASE_STATE_CHANGED broadcast intent, enabling you to verify that any given PURCHASE_STATE_CHANGED response corresponds to an actual request that you made. Every PURCHASE_STATE_CHANGED broadcast intent also includes a signed JSON string and a signature, which you can use to verify the integrity of the response.

    Your application must provide a way to generate, manage, and verify nonces. The following sample code shows some simple methods you can use to do this.

       private static final SecureRandom RANDOM = new SecureRandom();
-  private static HashSet<Long> sKnownNonces = new HashSet<Long>();   
+  private static HashSet<Long> sKnownNonces = new HashSet<Long>();
 
   public static long generateNonce() {
     long nonce = RANDOM.nextLong();
@@ -574,7 +656,7 @@ public class BillingReceiver extends BroadcastReceiver {
   }
    -

    Your application must also provide a way to verify the signatures that accompany every ACTION_PURCHASE_STATE_CHANGED broadcast intent. The Security.java file in the sample application shows you how to do this. If you use this file as a basis for your own security implementation, be sure to follow the guidelines in Security and Design and obfuscate your code.

    +

    Your application must also provide a way to verify the signatures that accompany every PURCHASE_STATE_CHANGED broadcast intent. The Security.java file in the sample application shows you how to do this. If you use this file as a basis for your own security implementation, be sure to follow the guidelines in Security and Design and obfuscate your code.

    You will need to use your Android Market public key to perform the signature verification. The following procedure shows you how to retrieve Base64-encoded public key from the Android Market publisher site.

    @@ -582,17 +664,17 @@ public class BillingReceiver extends BroadcastReceiver {
  • Log in to your publisher account.
  • On the upper left part of the page, under your name, click Edit profile.
  • On the Edit Profile page, scroll down to the Licensing & In-app Billing panel (see figure 2).
    • -
  • Copy your public key to the clipboard.
    • +
  • Copy your public key.

    • Important: To keep your public key safe from malicious users and hackers, do not embed your public key as an entire literal string. Instead, construct the string at runtime from pieces or use bit manipulation (for example, XOR with some other string) to hide the actual key. The key itself is not secret information, but you do not want to make it easy for a hacker or malicious user to replace the public key with another key.

    - -
    Figure 2. The Licensing and In-app Billing -panel of your account's Edit Profile page lets you see your public key.
    -
    + +

    + Figure 2. The Licensing and In-app Billing panel of your account's Edit Profile page lets you see your public key. +

    Modifying Your Application Code

    diff --git a/docs/html/guide/market/billing/billing_overview.jd b/docs/html/guide/market/billing/billing_overview.jd index b899b9b486845..36f9d53c7270c 100755 --- a/docs/html/guide/market/billing/billing_overview.jd +++ b/docs/html/guide/market/billing/billing_overview.jd @@ -3,12 +3,6 @@ parent.title=In-app Billing parent.link=index.html @jd:body - -

    In this document

    @@ -19,7 +13,7 @@ parent.link=index.html
  • Request messages
  • Broadcast intents
  • Messaging sequence
    • -
  • Handling ACTION_NOTIFY messages
    • +
  • Handling IN_APP_NOTIFY messages
  • Security Controls
  • Requirements and Limitations
    • @@ -40,10 +34,10 @@ parent.link=index.html
    -

    This documentation provides an early look at the Android Market In-app Billing service. The documentation may change without notice.

    +

    During the testing phase of the in-app billing release you cannot publish applications that implement in-app billing. You can only upload in-app billing applications as draft applications. For more information, see About this Release

    -

    The Android Market In-app Billing service is an Android Market feature that provides checkout processing for in-app purchases. To use the service, your application sends a billing request to the service for a specific in-app product. The service then handles all of the checkout details for the transaction, including requesting and validating the form of payment and processing the financial transaction. When the checkout process is complete, the service sends your application the purchase details, such as the order number, the order date and time, and the price paid. At no point does your application have to handle any financial transactions; that role is provided by the in-app billing service.

    +

    The Android Market In-app Billing service is an Android Market feature that provides checkout processing for in-app purchases. To use the service, your application sends a billing request for a specific in-app product. The service then handles all of the checkout details for the transaction, including requesting and validating the form of payment and processing the financial transaction. When the checkout process is complete, the service sends your application the purchase details, such as the order number, the order date and time, and the price paid. At no point does your application have to handle any financial transactions; that role is provided by the in-app billing service.

    In-app Billing Architecture

    @@ -52,8 +46,9 @@ parent.link=index.html

    Some in-app billing implementations may also use a private remote server to deliver content or validate transactions, but a remote server is not required to implement in-app billing. A remote server can be useful if you are selling digital content that needs to be delivered to a user's device, such as media files or photos. You might also use a remote server to store users' transaction history or perform various in-app billing security tasks, such as signature verification. Although you can handle all security-related tasks in your application, performing those tasks on a remote server is recommended because it helps make your application less vulnerable to security attacks.

    - -

    Figure 1. Your application sends and receives billing messages through the Android Market application, which handles all communication with the Android Market server.

    + +

    + Figure 1. Your application sends and receives billing messages through the Android Market application, which handles all communication with the Android Market server.

    A typical in-app billing implementation relies on three components:

    @@ -77,7 +72,7 @@ parent.link=index.html

    In-app billing requests

    -

    Your application sends in-app billing requests by invoking a single IPC method (sendBillingRequest()), which is exposed by the MarketBillingService interface. This interface is defined in an Android Interface Definition Language file (IMarketBillingService.aidl). You can download this AIDL file with the in-app billing sample application.

    +

    Your application sends in-app billing requests by invoking a single IPC method (sendBillingRequest()), which is exposed by the MarketBillingService interface. This interface is defined in an Android Interface Definition Language file (IMarketBillingService.aidl). You can download this AIDL file with the in-app billing sample application.

    The sendBillingRequest() method has a single {@link android.os.Bundle} parameter. The Bundle that you deliver must include several key-value pairs that specify various parameters for the request, such as the type of billing request you are making, the item that is being purchased, and the application that is making the request. For more information about the Bundle keys that are sent with a request, see In-app Billing Service Interface. @@ -97,7 +92,7 @@ parent.link=index.html

    This request acknowledges that your application received the details of a purchase state change. Android Market sends purchase state change notifications to your application until you confirm that you received them.

  • RESTORE_TRANSACTIONS -

    This request retrieves a user's transaction status for managed purchases (see Choosing a Purchase Type for more information). You should send this request only when you need to retrieve a user's transaction status, which is usually only when your application is reinstalled or installed for the first time on a device.

    +

    This request retrieves a user's transaction status for managed purchases. You should send this request only when you need to retrieve a user's transaction status, which is usually only when your application is reinstalled or installed for the first time on a device.

    • @@ -121,18 +116,18 @@ parent.link=index.html

    The asynchronous response messages are sent in the form of individual broadcast intents and include the following:

    -

    The JSON string that is returned with the ACTION_PURCHASE_STATE_CHANGED intent provides your application with the details of one or more billing transactions. An example of this JSON string is shown below:

    +

    The JSON string that is returned with the PURCHASE_STATE_CHANGED intent provides your application with the details of one or more billing transactions. An example of this JSON string is shown below:

     { "nonce" : 1836535032137741465,
   "orders" :
@@ -146,113 +141,85 @@ parent.link=index.html
 }
    -

    The fields in the JSON string are described in the following table (see table 1):

    - -

    Table 1. Description of JSON fields that are returned with an ACTION_PURCHASE_STATE_CHANGED intent.

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    FieldDescription
    nonceA number used once. Your application generates the nonce and sends it with the GET_PURCHASE_INFORMATION request. Android Market sends the nonce back as part of the JSON string so you can verify the integrity of the message.
    notificationIdA unique identifier that is sent with an ACTION_NOTIFY broadcast intent. Each notificationId corresponds to a specify message that is waiting to be retrieved on the Android Market server. Your application sends back the notificationId with the GET_PURCHASE_INFORMATION message so Android Market can determine which messages you are retrieving.
    orderIdA unique order identifier for the transaction. This corresponds to the Google Checkout Order ID.
    packageNameThe application package from which the purchase originated.
    productIdThe item's product identifier. Every item has a product ID, which you must specify in the application's product list on the Android Market publisher site.
    purchaseTimeThe time the product was purchased, in milliseconds since the epoch (Jan 1, 1970).
    purchaseStateThe enum value for the purchase state, which indicates whether the purchase was successful, canceled, or refunded.
    developerPayloadA developer-specified string that is associated with an order. This field is returned in the JSON string that contains transaction information for an order. You can use this field to send information with an order. For example, you can use this field to send index keys with an order, which is useful if you are using a database to store purchase information. We recommend that you do not use this field to send data or content.
    +

    For more information about the fields in this JSON string, see In-app Billing Broadcast Intents.

    Messaging sequence

    -

    The messaging sequence for a typical purchase request is shown in Figure 2. Request types for each sendBillingRequest() method are shown in bold, responses are shown in standard text. For clarity, Figure 2 does not show the ACTION_RESPONSE_CODE broadcast intents that are sent for every request. These responses provide status information or error information and are returned after each request.

    +

    The messaging sequence for a typical purchase request is shown in figure 2. Request types for each sendBillingRequest() method are shown in bold, broadcast intents are shown in italic. For clarity, figure 2 does not show the RESPONSE_CODE broadcast intents that are sent for every request.

    The basic message sequence for an in-app purchase request is as follows:

    1. Your application sends a purchase request (REQUEST_PURCHASE type), specifying a product ID and other parameters.
      2. -
    2. The Android Market application sends your application a Bundle with a RESPONSE_CODE, PURCHASE_INTENT, and REQUEST_ID. The PURCHASE_INTENT provides a {@link android.app.PendingIntent}, which your application uses to start the checkout flow for the given product ID.
      3. +
    3. The Android Market application sends your application a Bundle with the following keys: RESPONSE_CODE, PURCHASE_INTENT, and REQUEST_ID. The PURCHASE_INTENT key provides a {@link android.app.PendingIntent}, which your application uses to start the checkout UI for the given product ID.
    4. Your application launches the pending intent, which launches the checkout UI.
      5. -
    5. When the checkout flow finishes (that is, the user successfully purchases the item or cancels the purchase), Android Market sends your application a notification message (an ACTION_NOTIFY intent). The notification message includes a notification ID, which references the completed transaction.
      6. +
    6. When the checkout flow finishes (that is, the user successfully purchases the item or cancels the purchase), Android Market sends your application a notification message (an IN_APP_NOTIFY broadcast intent). The notification message includes a notification ID, which references the transaction.
    7. Your application requests the transaction information by sending a GET_PURCHASE_STATE_CHANGED request, specifying the notification ID for the transaction.
      8. -
    8. The Android Market application sends a Bundle with a RESPONSE_CODE and a REQUEST_ID. -
    9. Android Market sends the transaction information to your application in an ACTION_PURCHASE_STATE_CHANGED intent.
      10. +
    10. The Android Market application sends a Bundle with a RESPONSE_CODE key and a REQUEST_ID key. +
    11. Android Market sends the transaction information to your application in a PURCHASE_STATE_CHANGED broadcast intent.
    12. Your application confirms that you received the transaction information for the given notification ID by sending a confirmation message (CONFIRM_NOTIFICATIONS type), specifying the notification ID for which you received transaction information.
      13. -
    13. The Android Market applications sends your application a Bundle with a RESPONSE_CODE and a REQUEST_ID.
      14. +
    14. The Android Market application sends your application a Bundle with a RESPONSE_CODE key and a REQUEST_ID key.

    Note: You must launch the pending intent from an activity context and not an application context.

    -
    - -
    Figure 2. Message sequence for a typical purchase request. Request types for each sendBillingRequest() method are shown in bold (ACTION_RESPONSE_CODE broadcast intents have been omitted).
    -
    + +

    + Figure 2. Message sequence for a purchase request. +

    -

    The messaging sequence for a restore transaction request is shown in Figure 3. The request type for the sendBillingRequest() method is shown in bold, the responses are shown in standard text.

    +

    The messaging sequence for a restore transaction request is shown in figure 3. Request types for each sendBillingRequest() method are shown in bold, broadcast intents are shown in italic. For clarity, figure 3 does not show the RESPONSE_CODE broadcast intents that are sent for every request.

    - -

    Figure 3. Message sequence for a restore transactions request.

    + +

    + Figure 3. Message sequence for a restore transactions request. +

    -

    The request triggers three responses. The first is a {@link android.os.Bundle} with a RESPONSE_CODE and a REQUEST_ID. Next, the Android Market application sends an ACTION_RESPONSE_CODE broadcast intent, which provides status information or error information about the request. As always, the ACTION_RESPONSE_CODE message references a specific request ID, so you can determine which request an ACTION_RESPONSE_CODE message pertains to.

    +

    The request triggers three responses. The first is a {@link android.os.Bundle} with a RESPONSE_CODE key and a REQUEST_ID key. Next, the Android Market application sends a RESPONSE_CODE broadcast intent, which provides status information or error information about the request. As always, the RESPONSE_CODE message references a specific request ID, so you can determine which request a RESPONSE_CODE message pertains to.

    -

    The RESTORE_TRANSACTIONS request type also triggers an ACTION_PURCHASE_STATE_CHANGED broadcast intent, which contains the same type of transaction information that is sent during a purchase request, although you do not need to respond to this intent with a CONFIRM_NOTIFICATIONS message.

    +

    The RESTORE_TRANSACTIONS request type also triggers a PURCHASE_STATE_CHANGED broadcast intent, which contains the same type of transaction information that is sent during a purchase request, although you do not need to respond to this intent with a CONFIRM_NOTIFICATIONS message.

    -

    The messaging sequence for checking whether in-app billing is supported is shown in Figure 4. The request type for the sendBillingRequest() method is shown in bold, the response is shown in regular text.

    +

    The messaging sequence for checking whether in-app billing is supported is shown in figure 4. The request type for the sendBillingRequest() method is shown in bold.

    - -

    Figure 4. Message sequence for checking whether in-app billing is supported.

    + +

    + Figure 4. Message sequence for checking whether in-app billing is supported. +

    -

    The synchronous response for a CHECK_BILLING_SUPPORTED request provides a server response code. A RESULT_OK response code indicates that in-app billing is supported; a RESULT_BILLING_UNAVAILABLE response code indicates that the Android Market application does not support in-app billing and may need to be updated. A SERVER_ERROR can also be returned, indicating that there was a problem with the Android Market server. The RESULT_BILLING_UNAVAILABLE response code can also indicate that the user is ineligible for in-app billing (for example, the user resides in a country that does not allow in-app billing).

    +

    The synchronous response for a CHECK_BILLING_SUPPORTED request provides a Bundle with a server response code. A RESULT_OK response code indicates that in-app billing is supported; a RESULT_BILLING_UNAVAILABLE response code indicates that in-app billing is unavailable because the in-app billing API version you specified is unrecognized or the user is not eligible to make in-app purchases (for example, the user resides in a country that does not allow in-app billing). A SERVER_ERROR can also be returned, indicating that there was a problem with the Android Market server.

    -

    Handling ACTION_NOTIFY messages

    +

    Handling IN_APP_NOTIFY messages

    -

    Usually, your application receives an ACTION_NOTIFY intent from Android Market in response to a REQUEST_PURCHASE message (see figure 2). The ACTION_NOTIFY intent informs your application that the state of a requested purchase has changed. To retrieve the details of that state change, your application sends a GET_PURCHASE_INFORMATION request. Android Market responds with an ACTION_PURCHASE_STATE_CHANGED intent, which contains the details of the purchase state change. Your application then sends a CONFIRM_NOTIFICATIONS message, informing Android Market that you've received the purchase state change information.

    +

    Usually, your application receives an IN_APP_NOTIFY broadcast intent from Android Market in response to a REQUEST_PURCHASE message (see figure 2). The IN_APP_NOTIFY broadcast intent informs your application that the state of a requested purchase has changed. To retrieve the details of that purchase, your application sends a GET_PURCHASE_INFORMATION request. Android Market responds with a PURCHASE_STATE_CHANGED broadcast intent, which contains the details of the purchase state change. Your application then sends a CONFIRM_NOTIFICATIONS message, informing Android Market that you've received the purchase state change information.

    -

    When Android Market receives a CONFIRM_NOTIFICATIONS message for a given message, it usually stops sending ACTION_NOTIFY intents for that message. However, there are some cases where Android Market may send repeated ACTION_NOTIFY intents for a message even though your application has sent a CONFIRM_NOTIFICATIONS message. This can occur if a device loses network connectivity while you are sending the CONFIRM_NOTIFICATIONS message. In this case, Android Market might not receive your CONFIRM_NOTIFICATIONS message and it could send multiple ACTION_NOTIFY messages until it receives acknowledgement that you received the message. Therefore, your application must be able to recognize that the subsequent ACTION_NOTIFY messages are for a previously processed transaction. You can do this by checking the orderID that's contained in the JSON string because every transaction has a unique orderId.

    +

    When Android Market receives a CONFIRM_NOTIFICATIONS message for a given message, it usually stops sending IN_APP_NOTIFY intents for that message. However, there are some cases where Android Market may send repeated IN_APP_NOTIFY intents for a message even though your application has sent a CONFIRM_NOTIFICATIONS message. This can occur if a device loses network connectivity while you are sending the CONFIRM_NOTIFICATIONS message. In this case, Android Market might not receive your CONFIRM_NOTIFICATIONS message and it could send multiple IN_APP_NOTIFY messages until it receives acknowledgement that you received the message. Therefore, your application must be able to recognize that the subsequent IN_APP_NOTIFY messages are for a previously processed transaction. You can do this by checking the orderID that's contained in the JSON string because every transaction has a unique orderId.

    -

    Your application may also receive ACTION_NOTIFY intents even though your application has not sent a REQUEST_PURCHASE message. This can occur when a user has your application installed on two (or more) devices and the user makes an in-app purchase from one of the devices. In this case, Android Market sends an ACTION_NOTIFY message to the second device, informing the application that there is a purchase state change. Your application can handle this message the same way it handles the response from an application-initiated REQUEST_PURCHASE message, so that ultimately your application receives a purchase state change message that includes information about the item that's been purchased. This scenario applies only to items that have their purchase type set to "managed per user account."

    +

    There are two cases where your application may also receive IN_APP_NOTIFY broadcast intents even though your application has not sent a REQUEST_PURCHASE message. Figure 5 shows the messaging sequence for both of these cases. Request types for each sendBillingRequest() method are shown in bold, broadcast intents are shown in italic. For clarity, figure 5 does not show the RESPONSE_CODE broadcast intents that are sent for every request.

    + +
    + +

    + Figure 5. Message sequence for refunds and other unsolicited IN_APP_NOTIFY messages. +

    +
    + +

    In the first case, your application can receive an IN_APP_NOTIFY broadcast intent when a user has your application installed on two (or more) devices and the user makes an in-app purchase from one of the devices. In this case, Android Market sends an IN_APP_NOTIFY message to the second device, informing the application that there is a purchase state change. Your application can handle this message the same way it handles the response from an application-initiated REQUEST_PURCHASE message, so that ultimately your application receives a PURCHASE_STATE_CHANGED broadcast intent message that includes information about the item that has been purchased. This applies only to items that have their purchase type set to "managed per user account."

    + +

    In the second case, your application can receive an IN_APP_NOTIFY broadcast intent when Android Market receives a refund notification from Google Checkout. In this case, Android Market sends an IN_APP_NOTIFY message to your application. Your application can handle this message the same way it handles responses from an application-initiated REQUEST_PURCHASE message so that ultimately your application receives a PURCHASE_STATE_CHANGED message that includes information about the item that has been refunded. The refund information is included in the JSON string that accompanies the PURCHASE_STATE_CHANGED broadcast intent. Also, the purchaseState field in the JSON string is set to 2.

    Security Controls

    -

    To help ensure the integrity of the transaction information that is sent to your application, Android Market signs the JSON string that is contained in the ACTION_PURCHASE_STATE_CHANGED broadcast intent. Android Market uses the private key that is associated with your publisher account to create this signature. The publisher site generates an RSA key pair for each publisher account. You can find the public key portion of this key pair on your account's profile page. It is the same public key that is used with Android Market licensing.

    +

    To help ensure the integrity of the transaction information that is sent to your application, Android Market signs the JSON string that is contained in the PURCHASE_STATE_CHANGED broadcast intent. Android Market uses the private key that is associated with your publisher account to create this signature. The publisher site generates an RSA key pair for each publisher account. You can find the public key portion of this key pair on your account's profile page. It is the same public key that is used with Android Market licensing.

    When Android Market signs a billing response, it includes the signed JSON string (unencrypted) and the signature. When your application receives this signed response you can use the public key portion of your RSA key pair to verify the signature. By performing signature verification you can help detect responses that have been tampered with or that have been spoofed. You can perform this signature verification step in your application; however, if your application connects to a secure remote server then we recommend that you perform the signature verification on that server.

    In-app billing also uses nonces (a random number used once) to help verify the integrity of the purchase information that's returned from Android Market. Your application must generate a nonce and send it with a GET_PURCHASE_INFORMATION request and a RESTORE_TRANSACTIONS request. When Android Market receives the request, it adds the nonce to the JSON string that contains the transaction information. The JSON string is then signed and returned to your application. When your application receives the JSON string, you need to verify the nonce as well as the signature of the JSON string.

    -

    For more information about best practices for security and design, see Security and Design.

    +

    For more information about best practices for security and design, see Security and Design.

    In-app Billing Requirements and Limitations

    @@ -260,10 +227,12 @@ parent.link=index.html + +

    For more information about in-app billing requirements, see In-App Billing Availability and Policies.

    diff --git a/docs/html/guide/market/billing/billing_reference.jd b/docs/html/guide/market/billing/billing_reference.jd index 2e5c9c633f210..744c4d1a2b7f9 100755 --- a/docs/html/guide/market/billing/billing_reference.jd +++ b/docs/html/guide/market/billing/billing_reference.jd @@ -3,12 +3,6 @@ parent.title=In-app Billing parent.link=index.html @jd:body - -

    In this document

    @@ -34,7 +28,7 @@ parent.link=index.html
    -

    This documentation provides an early look at the Android Market In-app Billing service. The documentation may change without notice.

    +

    During the testing phase of the in-app billing release you cannot publish applications that implement in-app billing. You can only upload in-app billing applications as draft applications. For more information, see About this Release

    The following document provides technical reference information for the following:

    @@ -47,7 +41,7 @@ parent.link=index.html

    Android Market Server Response Codes for In-app Billing

    -

    The following table lists all of the server response codes that are sent from Android Market to your application. Android Market sends these response codes asynchronously as INAPP_RESPONSE_CODE extras in the ACTION_RESPONSE_CODE broadcast intent. Your application must handle all of these response codes.

    +

    The following table lists all of the server response codes that are sent from Android Market to your application. Android Market sends these response codes asynchronously as response_code extras in the com.android.vending.billing.RESPONSE_CODE broadcast intent. Your application must handle all of these response codes.

    Table 1. Summary of response codes returned by Android Market.

    @@ -71,7 +65,7 @@ parent.link=index.html RESULT_BILLING_UNAVAILABLE - Indicates that the BILLING_API_VERSION that you specified is not recognized by the Android Market application and that the Android Market application may have to be updated. Can also indicate that the user is ineligible for in-app billing. For example, the user resides in a country that does not allow in-app purchases. + Indicates that in-app billing is not available because the API_VERSION that you specified is not recognized by the Android Market application or the user is ineligible for in-app billing (for example, the user resides in a country that prohibits in-app purchases). RESULT_ITEM_UNAVAILABLE @@ -90,8 +84,8 @@ parent.link=index.html

    In-app Billing Service Interface

    -

    The following section describes the interface for the Android Market In-app Billing service. The interface is defined in the IMarketBillingService.aidl file, which is included with the in-app billing sample application.

    -

    The interface consists of a single request method sendBillingRequest(). This method takes a single {@link android.os.Bundle} parameter. The Bundle parameter includes several key-value pairs, which are summarized in Table 2.

    +

    The following section describes the interface for the Android Market in-app billing service. The interface is defined in the IMarketBillingService.aidl file, which is included with the in-app billing sample application.

    +

    The interface consists of a single request method sendBillingRequest(). This method takes a single {@link android.os.Bundle} parameter. The Bundle parameter includes several key-value pairs, which are summarized in table 2.

    Table 2. Description of Bundle keys passed in a sendBillingRequest() request.

    @@ -106,52 +100,52 @@ parent.link=index.html BILLING_REQUEST - String + String CHECK_BILLING_SUPPORTED, REQUEST_PURCHASE, GET_PURCHASE_INFORMATION, CONFIRM_NOTIFICATIONS, or RESTORE_TRANSACTIONS Yes The type of billing request you are making with the sendBillingRequest() request. The possible values are discussed more below this table. - BILLING_API_VERSION - int - 0 (for alpha release); 1 (for beta release) + API_VERSION + int + 1 Yes - The version of the in-app billing service you are using. + The version of the in-app billing service you are using. The current version is 1. PACKAGE_NAME - String + String A valid package name. Yes The name of the application that is making the request. ITEM_ID - String + String Any valid product identifier. Required for REQUEST_PURCHASE requests. The product ID of the item you are making a billing request for. Every in-app item that you sell using the in-app billing service must have a unique product ID, which you specify on the Android Market publisher site. NONCE - long - Any valid long value. + long + Any valid long value. Required for GET_PURCHASE_INFORMATION and RESTORE_TRANSACTIONS requests. - A number used once. Your application must generate and send a nonce with each GET_PURCHASE_INFORMATION and RESTORE_TRANSACTIONS request. The nonce is returned with the ACTION_PURCHASE_STATE_CHANGED intent, so you can use this value to verify the integrity of transaction responses form Android Market. + A number used once. Your application must generate and send a nonce with each GET_PURCHASE_INFORMATION and RESTORE_TRANSACTIONS request. The nonce is returned with the PURCHASE_STATE_CHANGED broadcast intent, so you can use this value to verify the integrity of transaction responses form Android Market. NOTIFY_IDS - Array of long values - Any valid array of long values + Array of long values + Any valid array of long values Required for GET_PURCHASE_INFORMATION and CONFIRM_NOTIFICATIONS requests. - An array of notification identifiers. A notification ID is sent to your application in an ACTION_NOTIFY intent every time a purchase changes state. You use the notification to retrieve the details of the purchase state change. + An array of notification identifiers. A notification ID is sent to your application in an IN_APP_NOTIFY broadcast intent every time a purchase changes state. You use the notification to retrieve the details of the purchase state change. DEVELOPER_PAYLOAD - String - Any valid String less than 256 characters long. + String + Any valid String less than 256 characters long. No - A developer-specified string that is associated with an order. This field is returned in the JSON string that contains transaction information for an order. You can use this field to send information with an order. For example, you can use this field to send index keys with an order, which is useful if you are using a database to store purchase information. We recommend that you do not use this field to send data or content. + A developer-specified string that can be specified when you make a REQUEST_PURCHASE request. This field is returned in the JSON string that contains transaction information for an order. You can use this key to send supplemental information with an order. For example, you can use this key to send index keys with an order, which is useful if you are using a database to store purchase information. We recommend that you do not use this key to send data or content. @@ -231,34 +225,81 @@ parent.link=index.html

    The following section describes the in-app billing broadcast intents that are sent by the Android Market application. These broadcast intents inform your application about in-app billing actions that have occurred. Your application must implement a {@link android.content.BroadcastReceiver} to receive these broadcast intents, such as the BillingReceiver that's shown in the in-app billing sample application.

    -

    ACTION_RESPONSE_CODE

    +

    com.android.vending.billing.RESPONSE_CODE

    -

    This broadcast intent contains an Android Market response code, and is sent after you make an in-app billing request. A server response code can indicate that a billing request was successfully sent to Android Market or it can indicate that some error occurred during a billing request. This intent is not used to report any purchase state changes (such as refund or purchase information). For more information about the response codes that are sent with this response, see Android Market Response Codes for In-app Billing.

    +

    This broadcast intent contains an Android Market response code, and is sent after you make an in-app billing request. A server response code can indicate that a billing request was successfully sent to Android Market or it can indicate that some error occurred during a billing request. This intent is not used to report any purchase state changes (such as refund or purchase information). For more information about the response codes that are sent with this response, see Android Market Response Codes for In-app Billing. The sample application assigns this broadcast intent to a constant named ACTION_RESPONSE_CODE.

    Extras
    -

    ACTION_NOTIFY

    +

    com.android.vending.billing.IN_APP_NOTIFY

    -

    This response indicates that a purchase has changed state, which means a purchase succeeded, was canceled, or was refunded. This response contains one or more notification IDs. Each notification ID corresponds to a specific server-side message, and each messages contains information about one or more transactions. After your application receives an ACTION_NOTIFY broadcast intent, you send a GET_PURCHASE_INFORMATION request with the notification IDs to retrieve the message details.

    +

    This response indicates that a purchase has changed state, which means a purchase succeeded, was canceled, or was refunded. This response contains one or more notification IDs. Each notification ID corresponds to a specific server-side message, and each messages contains information about one or more transactions. After your application receives an IN_APP_NOTIFY broadcast intent, you send a GET_PURCHASE_INFORMATION request with the notification IDs to retrieve the message details. The sample application assigns this broadcast intent to a constant named ACTION_NOTIFY.

    Extras
    -

    ACTION_PURCHASE_STATE_CHANGED

    +

    com.android.vending.billing.PURCHASE_STATE_CHANGED

    -

    This broadcast intent contains detailed information about one or more transactions. The transaction information is contained in a JSON string. The JSON string is signed and the signature is sent to your application along with the JSON string (unencrypted). To help ensure the security of your in-app billing messages, your application can verify the signature of this JSON string.

    +

    This broadcast intent contains detailed information about one or more transactions. The transaction information is contained in a JSON string. The JSON string is signed and the signature is sent to your application along with the JSON string (unencrypted). To help ensure the security of your in-app billing messages, your application can verify the signature of this JSON string. The sample application assigns this broadcast intent to a constant named ACTION_PURCHASE_STATE_CHANGED.

    Extras
    \ No newline at end of file +
  • inapp_signed_data—a String representing the signed JSON string.
    • +
  • inapp_signature—a String representing the signature.
    • + + +

    Note: Your application should map the broadcast intents and extras to constants that are unique to your application. See the Consts.java file in the sample application to see how this is done.

    + +

    The fields in the JSON string are described in the following table (see table 4):

    + +

    Table 4. Description of JSON fields that are returned with a PURCHASE_STATE_CHANGED intent.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    FieldDescription
    nonceA number used once. Your application generates the nonce and sends it with the GET_PURCHASE_INFORMATION request. Android Market sends the nonce back as part of the JSON string so you can verify the integrity of the message.
    notificationIdA unique identifier that is sent with an IN_APP_NOTIFY broadcast intent. Each notificationId corresponds to a specify message that is waiting to be retrieved on the Android Market server. Your application sends back the notificationId with the GET_PURCHASE_INFORMATION message so Android Market can determine which messages you are retrieving.
    orderIdA unique order identifier for the transaction. This corresponds to the Google Checkout Order ID.
    packageNameThe application package from which the purchase originated.
    productIdThe item's product identifier. Every item has a product ID, which you must specify in the application's product list on the Android Market publisher site.
    purchaseTimeThe time the product was purchased, in milliseconds since the epoch (Jan 1, 1970).
    purchaseStateThe purchase state of the order. Possible values are 0 (purchased), 1 (canceled), or 2 (refunded).
    developerPayloadA developer-specified string that contains supplemental information about an order. You can specify a value for this field when you make a REQUEST_PURCHASE request.
    diff --git a/docs/html/guide/market/billing/billing_testing.jd b/docs/html/guide/market/billing/billing_testing.jd index 5ced9c78da162..c900e8b777299 100755 --- a/docs/html/guide/market/billing/billing_testing.jd +++ b/docs/html/guide/market/billing/billing_testing.jd @@ -3,12 +3,6 @@ parent.title=In-app Billing parent.link=index.html @jd:body - -

    In this document

    @@ -33,28 +27,26 @@ parent.link=index.html
    -

    This documentation provides an early look at the Android Market In-app Billing service. The documentation may change without notice.

    +

    During the testing phase of the in-app billing release you cannot publish applications that implement in-app billing. You can only upload in-app billing applications as draft applications. For more information, see About this Release

    The Android Market publisher site provides several tools that help you test your in-app billing implementation before it is published. You can use these tools to create test accounts and purchase special reserved items that send static billing responses to your application.

    To test in-app billing in an application you must install the application on an Android-powered device. You cannot use the Android emulator to test in-app billing. The device you use for testing must run a standard version of the Android 1.6 or later platform (API level 4 or higher), and have the most current version of the Android Market application installed. If a device is not running the most current Android Market application, your application won't be able to send in-app billing requests to Android Market. For general information about how to set up a device for use in developing Android applications, see Developing on a Device.

    +href="{@docRoot}guide/developing/device.html">Using Hardware Devices.

    The following section shows you how to set up and use the in-app billing test tools.

    -

    Note: Debug log messages are turned off by default in the sample application. You can turn them on by setting the variable DEBUG to true in the Consts.java file.

    -

    Testing in-app purchases with static responses

    -

    We recommend that you first test your in-app billing implementation using static responses from Android Market. This enables you to verify that your application is handling the primary Android Market responses correctly and that your application is able to verify the signature correctly.

    +

    We recommend that you first test your in-app billing implementation using static responses from Android Market. This enables you to verify that your application is handling the primary Android Market responses correctly and that your application is able to verify signatures correctly.

    To test your implementation with static responses, you make an in-app billing request using a special item that has a reserved product ID. Each reserved product ID returns a specific static response from Android Market. No money is transferred when you make in-app billing requests with the reserved product IDs. Also, you cannot specify the form of payment when you make a billing request with a reserved product ID. Figure 1 shows the checkout flow for the reserved item that has the product ID android.test.purchased.

    -
    - -
    Figure 1. Checkout flow for the special reserved item android.test.purchased.
    -
    + +

    + Figure 1. Checkout flow for the special reserved item android.test.purchased. +

    You do not need to list the reserved products in your application's product list. Android Market already knows about the reserved product IDs. Also, you do not need to upload your application to the publisher site to perform static response tests with the reserved product IDs. You can simply install your application on a device, log into the device, and make billing requests using the reserved product IDs.

    @@ -68,14 +60,14 @@ href="{@docRoot}guide/developing/device.html">Developing on a Device.

    When you make an in-app billing request with this product ID Android Market responds as though the purchase was canceled. This can occur when an error is encountered in the order process, such as an invalid credit card, or when you cancel a user's order before it is charged.

  • android.test.refunded -

    When you make an in-app billing request with this product ID, Android Market responds as though the purchase was refunded. Refunds cannot be initiated through the in-app billing feature. Refunds must be initiated by you (the merchant). A refund message is sent to your app by Android Market only when Android Market gets notification from Google Checkout that a refund has been made.

    +

    When you make an in-app billing request with this product ID, Android Market responds as though the purchase was refunded. Refunds cannot be initiated through the in-app billing feature. Refunds must be initiated by you (the merchant). A refund message is sent to your application by Android Market only when Android Market gets notification from Google Checkout that a refund has been made. For more information about refunds, see Handling IN_APP_NOTIFY messages and In-app Billing Pricing.

  • android.test.item_unavailable -

    When you make an in-app billing request with this product ID Android Market responds as though the item being purchased was not listed in your app's product list.

    +

    When you make an in-app billing request with this product ID, Android Market responds as though the item being purchased was not listed in your application's product list.

    • -

    In some cases, the reserved items may return signed static responses, which lets you test signature verification in your application. To test signature verification with the special reserved product IDs, you may need to set up trusted tester accounts or upload your application as a unpublished draft application. The following table (Table 1) shows you the conditions under which static responses are signed.

    +

    In some cases, the reserved items may return signed static responses, which lets you test signature verification in your application. To test signature verification with the special reserved product IDs, you may need to set up test accounts or upload your application as a unpublished draft application. Table 1 shows you the conditions under which static responses are signed.

    Table 1. Conditions under which static responses are signed.

    @@ -119,7 +111,7 @@ Conditions under which static responses are signed.

    Yes No -Trusted tester +Test account Signed @@ -134,6 +126,22 @@ Conditions under which static responses are signed.

    To make an in-app billing request with a reserved product ID, you simply construct a normal REQUEST_PURCHASE request, but instead of using a real product ID from your application's product list you use one of the reserved product IDs.

    +

    To test your application using the reserved product IDs, follow these steps:

    + +
      +
    1. Install your application on an Android-powered device. +

      You cannot use the emulator to test in-app billing; you must install your application on a device to test in-app billing.

      +

      To learn how to install an application on a device, see Running on a device.

      +
      2. +
    2. Sign in to your device with your developer account. +

      You do not need to use a test account if you are testing only with the reserved product IDs.

      +
      3. +
    3. Verify that your device is running a supported version of the Android Market application or the MyApps application. +

      If your device is running Android 3.0, in-app billing requires version 5.0.12 (or higher) of the MyApps application. If your device is running any other version of Android, in-app billing requires version 2.3.4 (or higher) of the Android Market application. To learn how to check the version of the Android Market application, see Updating Android Market.

      +
      4. +
    4. Run your application and purchase the reserved product IDs.
      5. +
    +

    Note: Making in-app billing requests with the reserved product IDs overrides the usual Android Market production system. When you send an in-app billing request for a reserved product ID, the quality of service will not be comparable to the production environment.

    Testing In-app Purchases Using Your Own Product IDs

    @@ -146,29 +154,35 @@ Conditions under which static responses are signed.

    Also, a test account can purchase an item in your product list only if the item is published. The application does not need to be published, but the item does need to be published.

    -

    When you use a test account to purchase items, the account is billed through Google Checkout and your Google Checkout merchant account receives a payout for the purchase. Therefore, you need to refund purchases that are made with test accounts, otherwise the purchases will show up as actual payouts to your merchant account.

    +

    When you use a test account to purchase items, the test account is billed through Google Checkout and your Google Checkout Merchant account receives a payout for the purchase. Therefore, you may want to refund purchases that are made with test accounts, otherwise the purchases will show up as actual payouts to your merchant account.

    To test your in-app billing implementation with actual purchases, follow these steps:

      -
    1. Upload your application as a draft application to the publisher site. You do not need to publish your application to perform end-to-end testing with real product IDs.
      2. -
    2. Add items to the application's product list. Make sure that you publish the items (the application can remain unpublished). -

      See Creating a product list to learn how to do this.

      +
    3. Upload your application as a draft application to the publisher site. +

      You do not need to publish your application to perform end-to-end testing with real product IDs. To learn how to upload an application to Android Market, see Uploading applications.

      4. -
    4. Install your application on an Android-powered device. -

      See Developing on a Device for more information about how to do this.

      +
    5. Add items to the application's product list. +

      Make sure that you publish the items (the application can remain unpublished). See Creating a product list to learn how to do this.

      6. -
    6. Sign in to the device using one of the trusted tester accounts that you registered on the Android Market site. -

      We recommend that you make the test account the primary account on the device. To sign in to a device, do the following:

      +
    7. Install your application on an Android-powered device. +

      You cannot use the emulator to test in-app billing; you must install your application on a device to test in-app billing.

      +

      To learn how to install an application on a device, see Running on a device.

      +
      8. +
    8. Make one of your test accounts the primary account on your device. +

      To perform end-to-end testing of in-app billing, the primary account on your device must be one of the test accounts that you registered on the Android Market site. If the primary account on your device is not a test account, you must do a factory reset of the device and then sign in with one of your test accounts. To perform a factory reset, do the following:

        -
      1. Open Settings > Accounts & sync
        2. -
      2. Select Add Account and choose to add a "Google" account.
        3. -
      3. Select Next and then Sign in.
        4. -
      4. Enter the username and password of the test account.
        5. -
      5. Select Sign in. The system signs you in to the new account.
        6. +
      6. Open Settings on your device.
        7. +
      7. Touch Privacy.
        8. +
      8. Touch Factory data reset.
        9. +
      9. Touch Reset phone.
        10. +
      10. After the phone resets, be sure to sign in with one of your test accounts during the device setup process.
      9. -
    9. Make in-app purchases in your application.
      10. +
    10. Verify that your device is running a supported version of the Android Market application or the MyApps application. +

      If your device is running Android 3.0, in-app billing requires version 5.0.12 (or higher) of the MyApps application. If your device is running any other version of Android, in-app billing requires version 2.3.4 (or higher) of the Android Market application. To learn how to check the version of the Android Market application, see Updating Android Market.

      +
      11. +
    11. Make in-app purchases in your application.

    Note: The only way to change the primary account on a device is to do a factory reset, making sure you log on with your primary account first.

    diff --git a/docs/html/guide/market/billing/index.jd b/docs/html/guide/market/billing/index.jd index 698517981d63f..e7f8ee37375cb 100755 --- a/docs/html/guide/market/billing/index.jd +++ b/docs/html/guide/market/billing/index.jd @@ -1,12 +1,6 @@ page.title=In-app Billing @jd:body - -
    @@ -30,23 +24,23 @@ page.title=In-app Billing
    -

    This documentation provides an early look at the Android Market In-app Billing service. The documentation may change without notice.

    +

    During the testing phase of the in-app billing release you cannot publish applications that implement in-app billing. You can only upload in-app billing applications as draft applications. For more information, see About this Release

    In-app billing is an Android Market service that lets you sell digital content in your applications. You can use the service to sell a wide range of content, including downloadable content such as media files or photos, and virtual content such as game levels or potions.

    -

    When you use the Android Market In-app Billing service to sell an item, Android Market handles all checkout details so your application never has to directly process any financial transactions. Android Market uses the same checkout service that is used for application purchases, so your users experience a consistent and familiar purchase flow (see figure 1). Also, the transaction fee for in-app purchases is the same as the transaction fee for application purchases (30%).

    +

    When you use the Android Market in-app billing service to sell an item, Android Market handles all checkout details so your application never has to directly process any financial transactions. Android Market uses the same checkout service that is used for application purchases, so your users experience a consistent and familiar purchase flow (see figure 1). Also, the transaction fee for in-app purchases is the same as the transaction fee for application purchases (30%).

    -

    Any application that you publish through Android Market can implement in-app billing. No special account or registration is required other than an Android Market publisher account and a Google Checkout merchant account. Also, because the service uses no dedicated framework APIs, you can add in-app billing to any application that uses a minimum API level of 4 or higher.

    +

    Any application that you publish through Android Market can implement in-app billing. No special account or registration is required other than an Android Market publisher account and a Google Checkout Merchant account. Also, because the service uses no dedicated framework APIs, you can add in-app billing to any application that uses a minimum API level of 4 or higher.

    To help you integrate in-app billing into your application, the Android SDK provides a sample application that demonstrates a simple implementation of in-app billing. The sample application contains examples of billing-related classes you can use to implement in-app billing in your application. It also contains examples of the database, user interface, and business logic you might use to implement in-app billing.

    Important: Although the sample application is a working example of how you can implement in-app billing, we strongly recommend that you modify and obfuscate the sample code before you use it in a production application. For more information, see Security and Design.

    -
    - -
    Figure 1. Applications initiate in-app billing requests through their own UI (first screen). Android Market responds to the request by providing the checkout user interface (middle screen). When checkout is complete, the application resumes.
    -
    + +

    + Figure 1. Applications initiate in-app billing requests through their own UI (first screen). Android Market responds to the request by providing the checkout user interface (middle screen). When checkout is complete, the application resumes. +

    To learn more about the in-app billing service and start integrating in-app billing into your applications, read the following documents:

    diff --git a/docs/html/images/billing_product_list_entry.png b/docs/html/images/billing_product_list_entry.png new file mode 100755 index 0000000000000..b7bfc7a4fbae9 Binary files /dev/null and b/docs/html/images/billing_product_list_entry.png differ diff --git a/docs/html/images/billing_refund.png b/docs/html/images/billing_refund.png new file mode 100755 index 0000000000000..09fc33c30aa8d Binary files /dev/null and b/docs/html/images/billing_refund.png differ diff --git a/docs/html/images/billing_request_purchase.png b/docs/html/images/billing_request_purchase.png index e8a1b30aa687a..c84016e8f0a04 100755 Binary files a/docs/html/images/billing_request_purchase.png and b/docs/html/images/billing_request_purchase.png differ diff --git a/docs/html/images/billing_restore_transactions.png b/docs/html/images/billing_restore_transactions.png index 116aa0ee3e174..7911304e50795 100755 Binary files a/docs/html/images/billing_restore_transactions.png and b/docs/html/images/billing_restore_transactions.png differ