title: Secure purchase premium IAP
body: <p>I have an app that i want to use google pay for only 1 non-consumable upgrade , I use below code to get status of my google play purchase</p>
  
  <pre><code>override fun onPurchasesUpdated(
      billingResult: BillingResult?,
      purchases: MutableList&lt;Purchase&gt;?
  ) {
      if (billingResult?.responseCode == BillingClient.BillingResponseCode.OK &amp;&amp; purchases != null) {
          for (purchase in purchases) { 
              handlePurchase(purchase) 
              // set user preference bool value if status is purchased 
          }
      } 
  }
  </code></pre>
  
  <p>and set the bool preference to true to hide ads , from google here</p>
  
  <p><a href="https://developer.android.com/google/play/billing/billing_library_overview" rel="nofollow noreferrer">https://developer.android.com/google/play/billing/billing_library_overview</a></p>
  
  <p>In section <code>Verify a purchase</code> They say </p>
  
  <blockquote>
    <p>Note: It's highly recommended to verify purchase details using a secure backend server that you trust. When a server isn’t an option, you can perform less-secure validation within your app.</p>
  </blockquote>
  
  <p>my question is </p>
  
  <p><strong>Is that a usual practice or i should use a server to verify from reverse engineering and if so Wouldn't that happen also with the server ?</strong> </p>