Android Question Verifying in-app purchases outside the device that performed the transaction?

[Alessandro71]

I'm working on a workflow where the user buys a "coin" (one-time product) in-app.

The token is used to consume an external service, provided by a server component, that is not running on the phone where the app is running.
The server component is run by the company I work for, so it can be customized at will.

I'm planning on sending the PurchaseToken to the server after acknowledging the purchase (I'm referring to the in-app purchase sample provided here: https://www.b4x.com/android/forum/threads/googleplaybilling-in-app-purchases.109945/).
How can I be sure (server-side) that the received purchased "coin" is regularly acquired using the app and not a forged one?

Is there a way for a server to verify that the received PurchaseToken matches a Google Play one-time product that was purchased successfully?

 

[Erel]

The process is explained here: https://developer.android.com/google/play/billing/security
There is a developer REST API that you can use to verify. Probably requires some configuration.

 

[Alessandro71]

I'm also using this as a guide:

How to verify purchase for android app in server side (google play in app billing v3)

I have a simple app (needs user login with account). I provide some premium features for paid users, like more news content. I need to record if the user has bought this item in my server database...

stackoverflow.com