Download the PHP package bijay-x/laravel-in-app-purchase without Composer
On this page you can find all versions of the php package bijay-x/laravel-in-app-purchase. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download bijay-x/laravel-in-app-purchase
More information about bijay-x/laravel-in-app-purchase
Files in bijay-x/laravel-in-app-purchase
Package laravel-in-app-purchase
Short Description Production-ready Laravel package for server-side verification of in-app purchases and subscriptions for iOS and Android
License MIT
Informations about the package laravel-in-app-purchase
Laravel In-App Purchase Verification Package
A production-ready Laravel package for server-side verification of in-app purchases and subscriptions for both Apple App Store (iOS) and Google Play Store (Android).
Features
- ✅ Apple App Store verification (receipt validation)
- ✅ Google Play Store verification (subscriptions & one-time purchases)
- ✅ Automatic sandbox fallback for Apple (status 21007)
- ✅ Subscription status tracking (active, expired, cancelled)
- ✅ Database storage for subscriptions
- ✅ Webhook support for real-time updates
- ✅ Clean architecture with SOLID principles
- ✅ Type-safe DTOs and contracts
- ✅ Comprehensive error handling and logging
Requirements
- PHP ^8.1
- Laravel ^10.0|^11.0|^12.0
- Google API Client Library (automatically installed)
Installation
1. Install via Composer
2. Publish Configuration
3. Publish Migrations
Configuration
Environment Variables
Add these to your .env file:
Apple App Store Setup
- Go to App Store Connect
- Navigate to your app → App Information → App-Specific Shared Secret
- Generate or copy your shared secret
- Add it to your
.envfile asIAP_APPLE_SHARED_SECRET
Google Play Store Setup
- Go to Google Cloud Console
- Create a new project or select an existing one
- Enable the Google Play Android Developer API
- Create a Service Account:
- Go to IAM & Admin → Service Accounts
- Create a new service account
- Download the JSON key file
- Link the service account to your Google Play Console:
- Go to Google Play Console → Settings → API access
- Link your service account
- Grant View financial data permission
- Place the JSON file in
storage/app/private/google-service-account.json - Update
.envwith the path:IAP_GOOGLE_SERVICE_ACCOUNT_PATH=storage/app/private/google-service-account.json
Usage
Basic Verification
Using the Facade
Using Dependency Injection
API Endpoint
The package provides a ready-to-use API endpoint:
POST /api/iap/verify
Request Body:
Response:
Flutter Integration Example
iOS (Apple)
Android (Google)
React Native Integration Example
iOS
Android
Webhooks
The package includes webhook endpoints for real-time subscription updates from Apple and Google.
Apple Webhook
POST /api/iap/webhook/ios or /api/iap/webhook/apple
Configure this URL in App Store Connect:
- Go to App Store Connect → Your App → App Information
- Set the Server Notification URL to:
https://your-api.com/api/iap/webhook/ios
Google Webhook
POST /api/iap/webhook/android or /api/iap/webhook/google
Configure this URL in Google Play Console:
- Go to Google Play Console → Your App → Monetization → Subscriptions
- Set the Real-time developer notifications URL to:
https://your-api.com/api/iap/webhook/android
Webhook Payload Examples
Apple Notification Types
INITIAL_BUY- First purchaseDID_RENEW- Subscription renewedDID_RECOVER- Subscription recoveredDID_FAIL_TO_RENEW- Renewal failedDID_CANCEL- Subscription cancelledEXPIRED- Subscription expired
Google Notification Types
SUBSCRIPTION_PURCHASED(4)SUBSCRIPTION_RENEWED(2)SUBSCRIPTION_RECOVERED(1)SUBSCRIPTION_CANCELED(3)SUBSCRIPTION_EXPIRED(12)
Database Schema
The package creates an iap_subscriptions table with the following structure:
VerificationResult DTO
The VerificationResult DTO provides useful methods:
Security Best Practices
- Always verify on the server: Never trust client-side purchase data
- Use HTTPS: All API endpoints should use HTTPS
- Authenticate requests: Add authentication middleware to protect endpoints
- Validate user ownership: Ensure the user_id matches the authenticated user
- Store credentials securely: Never commit service account files or shared secrets to version control
- Rate limiting: Implement rate limiting on verification endpoints
- Logging: Monitor logs for suspicious activity
Adding Authentication Middleware
Error Handling
The package handles various error scenarios:
- Invalid receipts/tokens: Returns
valid: falsewith error details - Network errors: Logs errors and returns error status
- Sandbox fallback: Automatically retries with sandbox URL for Apple (status 21007)
- Missing credentials: Logs warnings and returns error status
Check the raw_data field in VerificationResult for detailed error information.
Testing
Apple Sandbox Testing
- Use sandbox test accounts in App Store Connect
- Test purchases will automatically fallback to sandbox URL
- Sandbox receipts expire after a short period
Google Testing
- Use test accounts in Google Play Console
- Test purchases are automatically handled
- Use the Google Play Console to manage test subscriptions
Troubleshooting
Apple Verification Issues
- Status 21007: Automatically handled (sandbox fallback)
- Status 21008: Receipt is from production but sent to sandbox
- Status 21010: Receipt data is malformed
- Check your shared secret is correct
Google Verification Issues
- 401 Unauthorized: Check service account JSON file path and permissions
- 403 Forbidden: Ensure service account has proper permissions in Play Console
- 404 Not Found: Verify package name and product ID are correct
License
MIT
Support
For issues, questions, or contributions, please visit the GitHub repository.
Changelog
1.0.0
- Initial release
- Apple App Store verification
- Google Play Store verification
- Webhook support
- Database storage
- Comprehensive documentation
All versions of laravel-in-app-purchase with dependencies
illuminate/support Version ^10.0|^11.0|^12.0
illuminate/http Version ^10.0|^11.0|^12.0
illuminate/database Version ^10.0|^11.0|^12.0
guzzlehttp/guzzle Version ^7.0
google/apiclient Version ^2.15
nesbot/carbon Version ^2.0|^3.0