CODEWITHSUNDEEP
androidioscordova
David
David

Reputation: 43

How to get the user id (or unique token) to make sure the app was bought in the app store

My system consists of a mobile app (a Cordova app), and a webservice, providing all the relevant data. When a user buys the app in the appstore (or playstore, if android), a user account should be created on the webservice, ideally without any user interaction (no registration). The user account could be linked with the gmail account, apple id, ... This is required, to only allow people who have paid to use the webservice.

My Problems:

  1. I did not find a way to get the user id of the user. (Android seems to have a way: https://github.com/loicknuchel/cordova-device-accounts , but iOS not).

  2. I only want exactly one registration per user. This saves me from using something like a registration page, when the app is first started - this could easily be bypassed and lead to multiple registrations.

  3. The user account should be linked to the user and not the device (so no device UUID or so, as this would not be portable between devices).

Ideas that I had:

  1. (Favorite, doesn't seem to be possible) I have a method "getUserID()" in the app, which returns the right user on the phone. Additionally, I have access to an API to check who bought my App. I can easily cross check, to make sure that the user has permission to use the webservice.

  2. (Unnecessary complicated, seems wrong) Make the app free, use a single in-app purchase to buy access to the webservice. When I searched, I found that it seems that in app purchases give you more information, so there might be the chance to link the app with a user.

  3. (Even worse than 2.) Make the app free, use an own payment system/registration.

My question:

What does the Android/iOS app-store eco system provide, so that I can ensure that one user buying the app creates exactly one user account on my webservice, and this user account is linked to the user and not the device?

Upvotes: 0

Views: 948

Answers (1)

MarkySmarky
MarkySmarky

Reputation: 1629

You should generate a secret api key for each paying user. Then the user should use this key to auth into your API and get a token back (you can make it expire after some time if you want a stronger protection). User should attach this token to all of his api calls.

Upvotes: 0

Related Questions