title: How do we verify Android in-app billing receipt on the server side?
body: <p>I am implementing in-app billing into an Android game and we want to use a server to store the purchase information.</p>
  
  <p>According to what I understood so far, Android Market will return a callback to the app in the form of Broadcast receiver about the purchase status. But since we are persisting the transaction information on the server, my app has to make some http post request and update my server. There is a very high chance that this http post request could be imitated by some hacker manually. How do I validate that Android market receipt information from my server code?</p>
  
  <p>Is there any Google checkout callback to my server available? Or is there a way to validate the IAB response provided by the http client is genuine and it is a purchase done in my app only!</p>
  
  <p>On the Apple IOS IAP process, <a href="https://developer.apple.com/library/ios/releasenotes/General/ValidateAppStoreReceipt/Introduction.html" rel="noreferrer">they have a validate web API</a> @ <a href="https://sandbox.itunes.apple.com/verifyReceipt" rel="noreferrer">https://sandbox.itunes.apple.com/verifyReceipt</a> for which we can pass</p>
  
  <pre><code>req.method = URLRequestMethod.POST;
  req.data = "{\"receipt-data\" : \""+ t.receipt +"\"}";
  </code></pre>
  
  <p>and it says if the receipt is proper or not. Do we have something like that for Android?</p>