A unique opaque string issued by Google Play (or transaction identifier by Apple) that represents a single in-app purchase — the credential your server verifies.
A purchase token is a long, opaque string generated by Google Play's billing system when a user completes an in-app purchase. It serves as proof of purchase and must be sent to your backend, which then calls the Google Play Developer API (or Apple's App Store Server API) to verify its authenticity and retrieve the purchase state.
Purchase tokens are sensitive credentials. A leaked token could allow an attacker to replay a verification. This is why Tierux hashes tokens for deduplication, encrypts a copy (AES-256-GCM) only for refresh operations, and never persists raw tokens on disk. The Apple equivalent is the transaction identifier combined with the signed JWS transaction.
Purchase tokens are the primary input to server-side validation — the server calls the store to verify them.
Real-Time Developer Notifications use purchase tokens to notify your backend about subscription state changes.
After verification, a purchase token maps to an entitlement — the normalized record of what the user can access.
Free tier — unlimited apps, 1 paywall. No credit card, no revenue share.
Start free