title: Am I getting the steps right for verifying a user's Android in-app subscription?
body: <p>I am making an app that does not require a user account/login, and allows the user to purchase a subscription. I want to use the Google Play Developer API to verify whether or not a user has a purchased/active subscription. From all of the documentation, I've gathered the following steps.</p>
  
  <p>Are they correct, and could you answer the two questions in them?</p>
  
  <ol>
  <li>Create a <a href="https://developers.google.com/accounts/docs/OAuth2#serviceaccount" rel="noreferrer">Service Account</a> in the Google APIs Console.</li>
  <li>Save the private key that is given to me (where? surely not in my code/on the device as <a href="https://code.google.com/p/google-api-java-client/wiki/OAuth2#Service_Accounts" rel="noreferrer"><strong>this sample code</strong></a> suggests)</li>
  <li>Use <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount" rel="noreferrer">Google APIs Client Library for Java</a> to create and sign a JWT with the private key (how? <a href="https://developers.google.com/accounts/docs/OAuth2ServiceAccount#jwtcontents" rel="noreferrer"><strong>the docs give me this</strong></a>, but that is not Java code... What do I do with it?) </li>
  <li>Construct an access token request, and get access to the API </li>
  <li>Application can now send a <a href="https://developers.google.com/android-publisher/v1/purchases/get" rel="noreferrer">GET</a> request to the API to find out whether or not the
  user has a subscription </li>
  <li>When the access token expires, go back to step 3.</li>
  </ol>
  
  <p>Also, I have a web service, though I know nothing about web services or web service programming... I only know enough to be aware that it is probably necessary to use here.</p>
  
  <p><strong>EDIT: These steps were not correct. See my answer below for the correct steps. However, note that this only applies to using a service account (because I did not want to require a user to have to explicitly allow API access)</strong></p>