The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos.
When a user pays, the app sends a request to the server, which contains the amount of money paid. The server in turn is responsible for sending a POST request to the right Arduino.
Since anyone can decompile the application and figure out how to make a request to the server with an arbitrary amount of money paid, how can this exchange be secured?
- User and password authorization (with hardcored values) will not work, because the user and password can just be extracted from the app
- Embedding a key file will not work because of the same reason
- Authorizing based on Google accounts will not work because I need to authorize the application, not the user (that is, the user can just use those credentials to make an arbitrary request outside from the app, which is not desirable)
I thought about leveraging the "payment confirmation" from the payment providers to ensure that a payment is done, but this payment is made in-app, so I don't know if it can be secure. Should I use a "return URL" so that Paypal (for example) makes the request to the server?
Thank you.
