The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos.

When a user pays, the app sends a request to the server, which contains the amount of money paid. The server in turn is responsible for sending a POST request to the right Arduino.

Since anyone can decompile the application and figure out how to make a request to the server with an arbitrary amount of money paid, how can this exchange be secured?

  • User and password authorization (with hardcored values) will not work, because the user and password can just be extracted from the app
  • Embedding a key file will not work because of the same reason
  • Authorizing based on Google accounts will not work because I need to authorize the application, not the user (that is, the user can just use those credentials to make an arbitrary request outside from the app, which is not desirable)

I thought about leveraging the "payment confirmation" from the payment providers to ensure that a payment is done, but this payment is made in-app, so I don't know if it can be secure. Should I use a "return URL" so that Paypal (for example) makes the request to the server?

Thank you.

1 Answer 1


Process or verify the payment server-side. This works for paypal und afaik your server can see in-app purchases of a authorized app and specific user, too. Just dig into the documentation on PayPal, Google Play e.t.c

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .