Security, keylogging and accounts An in-app purchase requests password verification before the transaction. Thus, all the following input into the onscreen keyboard is the user's password. 

Is handling keyboard events prevented at this stage so the app developer can't log individual strokes? Does it need to be a rooted device to log them?

Can't this then be matched with GET_ACCOUNTS or a similar function?

Thanks
In-app purchases with Google Play don't take place in the app you're purchasing in. The dialog to confirm your password and make your purchase is part of the Play Store app. There's no way for the calling app to see or intercept what you type into it. It's no different to any other app in that respect.

Be careful to only input your password into the real Play Store dialog. As always, the soft keyboard can see anything you type in any app, so you have to trust it not to abuse your password and other sensitive information.