Security API - App Store In App Purchases

The Pugpig clients come with an out of the box integration with the vendor ecosystems to allow one-click purchases of subscriptions and single issues. In order to sell items yourself, you need to set up a few items. The same principles apply for all the supported ecosystems, which are currently:

• Apple iTunes (iOS)
• Google Play (Android)
• Amazon App Store (Android)
• Windows Store (Windows)
• Blackberry App World (Blackberry)

Set up your vendor portal

The Product IDs of the editions in the OPDS feed must match the Product IDs in the external entitlements system to ensure access is granted to the correct editions. It is important you use the identical single issue Product ID’s across all the vendor stores you’re offering in your apps. An example being a single issue purchase for the November edition of Pugpig Magazine com.pugpigmagazine.issue.20131101 is a suitable Product ID and would need to be set up in all vendor store portals (iTunes, Amazon, Google) with the relevant price and details.

For more information, see:

iTunes: Adding In App Purchases

Amazon: Adding Amazon In App Purchases

Google: Adding Google Play store in App Purchases

Configure the client

The client application will need to be configured to contain your store keys. See the links in the Vendor Portal section above for details.

Validate store receipts on the server

When a client buys a subscription from a Vendor Store, the communication is directly between the client and the store. However, the client then needs to use this receipt to obtain an edition credentials token for each product. It does this by sending the receipt to a server, along with the ID of the edition it is trying to download. The server should then send that receipt to the vendor store to ensure it is real and, if it is valid, return the token.

The Pugpig Professional Services team can provide server side receipt validators if you need them. You can also download them as part of some of the existing connectors. They are entirely generic - one per each store. Contact support@pugpig.com for help.

Securing your content

It is important to remember that implementing everything described above will mean a user will get an edition credentials token that will allow them to access an issue. You still need to ensure your content server is validating these tokens if you want tight security. See Securing your content