A non-human Google Cloud identity that lets a backend call the Play Developer API with explicitly granted permissions.
A service account represents software rather than an employee. Google Cloud issues credentials for that identity, and authorization policies determine which resources it may access. In mobile billing, a secure server commonly uses a service account to call the Google Play Developer API for purchase verification, subscription state, acknowledgement, refunds, and catalog operations. The Android app must never contain the private credential; distributing it to clients would let anyone impersonate the backend.
Creating the Cloud identity is only part of setup. The relevant API must be enabled, and the service-account email must receive suitable access in Play Console for the developer account or app. Least privilege matters: grant only the financial, order, or app-management capabilities required by the integration. Organization policy may favor workload identity or managed runtime credentials instead of downloadable JSON keys. When a key is unavoidable, store it in a secret manager, restrict access, rotate it, and remove superseded material.
A server obtains an OAuth access token for the service account, then sends an authenticated request to the Android Publisher endpoint. For purchase verification, the request includes the app package, product context, and opaque purchase token received from the client. Google returns authoritative state; the backend validates it, maps the product to an entitlement, and persists only what its security model permits. API authorization proves which workload is calling Google, while purchase verification proves what the customer bought—neither replaces the other.
Operational checks should cover disabled keys, missing Play permissions, wrong package names, quota errors, and rotation. Audit logs help distinguish authentication failure from an invalid purchase. Tierux’s MCP setup flow can guide and automate Google-side provisioning steps, while the developer still completes Play Console access where Google requires a human action. Apple uses App Store Connect API credentials and signed StoreKit data rather than a Google Cloud service account, so the term should not be generalized across both stores.
The store system whose server API is accessed by the workload identity.
The secure verification process that uses authenticated store calls.
The agent tool protocol Tierux uses to guide integration setup.
Use narrowly authorized workload identities for verification.
Start free