Unity IAP Store Guides - Amazon, Apple, Google Play, Windows

Hi @pea,

Thanks for the additional info, I will try to test some IAPs over the weekend and see if I can duplicate it. And we'll update this page when we've released an update to provide greater error messaging.

We are investigating issues with sandbox test purchases showing up as verified revenue on Android, so we can update this thread about that when we know more also. It should be unrelated to the purchase error however.

Also great game! It's been really fun and looks great!

 

Thank you @erika_d! ~_~

If you end up making IAPs I will happily refund them. Thank you, thank you.

 

Hi @pea,

I made a couple test purchases but didn't get an unknown error message...I did get a connection timed out error the second time, but the purchase still went through and when I hit try again it said I already own the product. I can send you the log file for that if you're interested, but since it wasn't the unknown error I don't know if its helpful...

 

Hello @erika_d,

Thank you so much! These purchases went through fine it seems, yes. There was a single "Unknown" error over the weekend, from a person with German localisation. Someone that had tried on Friday it seemed and then tried again over the weekend. So the error seems to persist for people. I'm going to put solving it on the back burner for now.

If you message me your order numbers I will happily cancel them. Thanks again, amazing support!

 

Hello,

We are planning to use Unity IAP to switch from prime31 for android and ios stores. also amazon v2 support.

Everything looks great from what I read in the documentation so far but had a question on analytics for revenue report

Is it possible to not send Unity our game revenue reports (toggle analytics off?) and still use Unity IAP? This is purely because initially we would like to not report any revenue to Unity for privacy purposes as we are already doing our analytics stuff outside of Unity

 

Hey @jimma,

I've responded to your other post with this question: http://forum.unity3d.com/threads/toggling-analytics-with-unity-iap.418572/#post-2728360.

Thanks!

 

say @erika_d

A strange thing happened in analytics/IAP - possibly with 5.4.

For ordinary events with no dictionary, you used to be able to do this

UnityEngine.Analytics.Analytics.CustomEvent("yo", null);

it appears though, you must now do this

UnityEngine.Analytics.Analytics.CustomEvent("yo");

I don't mind but the change appears totally undocumented. What do you reckon? Am I correct that the latter form is now correct?

Frustrating to have every project break over that!

 

Hey @Fattie,

You're correct that that is a change in the new version of the editor. I'm very sorry for both the breaking of your projects and the lack of documentation! We are working on getting our documentation more up to date and I will make sure that this gets included with it. As for the breaking of the projects, I'll pass your feedback on to our editor team to see what they can do. Thanks for continuing to use Unity Analytics and IAP and for your feedback!

 

hi @erika_d no need to be sorry, thanks for the super-speedy response.

Right, if they could just take a moment to add to the documentation that you can do that that would be helpful I guess

The problem is - I can't find it just now - but me and I think nicholas_sr had a huge conversation about this topic somewhere on the web, and, the end conclusion was "yes you definitely put "null" at the end there to do that" heh!

so, many folks are probably googling to that. anyway no big deal - cheers!

For anyone googling, do THIS

UnityEngine.Analytics.Analytics.CustomEvent("yo");

if you want an "ordinary" event with no parameters in Unity Awesome Analytics. ie NO final parameter.

 

Question.

Let's say I have an android device how can I tell if it is using the playstore or the amazon store?

Right now I have a problem with amazon non kindle devices. I have a problem with identifying them as amazon devices. My app sees them as android devices. When they do purchases they contact the amazon store and the receipt verification fails because our server sees the device as android and gets an amazon receipt.

So to solve this problem I have to somehow recognize the non kindle devices as amazon.

Any ideas?

 

Question 2.

We have an iOS player that seems to have figured out how to bypass receipt verification. He keeps purchasing the biggest coin pack over and over again.

Our server side receipt validation says that receipts are ok. But we see that they are made on devices with different IDs and different IP. This smells fishy. Anyone ever seen something like this?

 

Hi @Mighty_Dragon_Studios,

For your first question: yes it is possible to get the type of android store, as long as you are on IAP 1.6.0 or higher. We don't have it well documented yet, but you can see a code example for how to do this in the Changelog for 1.6.0 found here: http://forum.unity3d.com/threads/unity-iap-store-package-1-8-1-is-now-available.415517/

Code (CSharp):

1. var builder = ConfigurationBuilder.Instance(StandardPurchasingModule.Instance());
2. Debug.Log(builder.Configure<IAndroidStoreSelection>().androidStore);

For your second question: Can you give us some more information about your receipt validation setup? Are you using client or server side receipt validation? Are you using Unity IAP's receipt validation? http://docs.unity3d.com/Manual/UnityIAPValidatingReceipts.html

 

We use the recommended by apple server side validation.

We figured out what was happening.

For some reason the payload we receive from iOS purchases did not have the product id. The scamer was sending valid receipts from other games without a product it. Apples server verified it so our server rewarded the player with virtual currency.

I couldn't find any info how to get the product id from the playload so I used the unity IAP veryfication. The respons to that verification had the product id and only after that we did the server side veryfication with the obtained product id. It looks like it stopped the scammer.

 

Hi @Mighty_Dragon_Studios,

Wow that sounds like a serious flaw in Apple's verification! Did you report it to them? I'm sure they would love to know about it if they don't already.

To clarify, IAP receipt validation does fail in this case, correct? This is why you are passing it through IAP's validation before sending it to Apple?

 

No it doesn't fail. The receipt is check and it is correct even if it doesn't contain the product it. That's why receipts from other games sent by scammers were verified by apples server.

The problem is when using Unity IAP, when you get the receipt from the store it doesn't have the product id for some reason. The result of the IAP receipt validation (one described in Unity manual) has the product id.

So when we are sending from our server the receipt + the product id it is validated for the right product and we are sure the receipt is valid.

 

Hi @Mighty_Dragon_Studios

Ah I see, thanks for that clarification. I have passed this information onto our IAP devs to look into if there is a better way that we can either provide the receipts (so they include the product id) or do the receipt validation (so we test/catch this case).

 

Great! Hope there is a better solution to this issue. IAP validation on device is not safe so I'm guessing that if someone tried hard enough they could still get over this double validation.

 

Hi @Mighty_Dragon_Studios

I talked to our IAP devs and we looked into the receipt validation code and did some research into the way Apple's receipt verification works and here is what we determined:

Starting with why receipts from other app's are being verified for your app: Apple (and by extension us, as our Receipt Validation uses Apple's verification) simply verifies that the receipt has been signed by the Apple certificate. This certificate is the same across all devices. According to one of their documentation pages, it is still up to the developer to check/verify that the bundle and version identifiers match the app's bundle and version identifiers.
https://developer.apple.com/library...AppStoreReceipt/Chapters/ValidateLocally.html

This would be true for our validator as well then, unfortunately we did not do a good job documenting this (we will work on improving/expanding the docs).

For the second part of the issue, where the receipt you're receiving from Unity IAP doesn't include the product id:
Are you accessing this receipt using args.purchasedProduct.receipt["Payload"] (or just args.purchasedProduct.receipt when passing to the receipt validator)? This Payload is the receipt exactly as it was passed to us from the app store, so if that doesn't contain the product id, then it should mean that the app store is not including the product id in the receipt.

Are any of your receipts showing the product id (before going through IAP receipt validation)? Is it just the fraudulent ones that don't have the product id?

 

This is what we do:

In PurchaseProcessingResult ProcessPurchase(PurchaseEventArgs e) function we deserialize the JSON hash

Code (CSharp):

1. string receipt = e.purchasedProduct.receipt;
2.         var wrapper = (Dictionary<string, object>)MiniJSON.Json.Deserialize(receipt);
3.         if (null == wrapper)
4.         {
5.             throw new InvalidReceiptDataException();
6.         }
7.  
8.         var store = (string)wrapper["Store"];
9.         var payload = (string)wrapper["Payload"];

now for iOS we just send the payload to our server as it is and from our server it is sent to Apple servers. In return we get a JSON like this one:

Code (CSharp):

1. Array
2. (
3.     [status] => valid
4.     [quantity] =>
5.     [product_id] =>
6.     [transaction_id] =>
7.     [purchase_date] =>
8.     [app_item_id] => 1117031418
9.     [bid] =>
10.     [bvrs] =>
11. )

To verify the product_id we do the verification on the device and send get the product_id that way. When we get it we send it to our server along with the payload. Our server knows which product was purchased by our players so we compare the two.

If we are doing something wrong please let me know. But the way we did it seemed to work till we started receiving receipts with wrong product_id (thankfully we has a system in place that notified us that something is not right). Right now with the double verification it seems we have stopped the scammers or we are unable to tell if they are still doing something.

Apologies for taking so long to reply to this thread.

 

@Mighty_Dragon_Studios your implementation seems to makes sense! I'm glad you got it working