title: How do I verify Android in-app-billing transactions on MY server?
body: <p>I have made an Android app where items can be purchased using <a href="http://developer.android.com/guide/market/billing/index.html" rel="noreferrer">in-app-billing</a>. When an item is purchased the transaction can easily be synced between Android Market and the phone - to be used in the app. But, I need MY server to be aware of the purchase. The decision to deliver app-specific data should be made on my server, not in the client app.</p>
  
  <p>E.g.</p>
  
  <ol>
  <li>User buys item X from Android Market.</li>
  <li>Transaction data Y is sent to the client.</li>
  <li>Client sends Y to my server.</li>
  <li>Client asks the server to deliver content for X.</li>
  <li>Server delivers content <strong>if Y is valid</strong>. How can this be accomplished?</li>
  </ol>
  
  <p><strong>Q:</strong> How do I verify that transaction data coming from the Android client (presumably originating from Google servers) is not fake? I.e. a hacker didn't generate the data.</p>
  
  <p>Google Server -> Android client -> My server -> Android client</p>
  
  <p>Perhaps this is more of a PHP question than anything else. Exactly what should my server script (PHP) do in order to verify that the retrieved data is real?</p>