PHP postback url google wallet IAP

Question

My postback php for google wallet in-app payments looks like this:

<?php
$payload = array(
  "iss" => $sellerIdentifier,
  "aud" => "Google",
  "typ" => "google/payments/inapp/item/v1",
  "exp" => time() + 3600,
  "iat" => time(),
  "request" => array (
    "name" => "pizza ",
    "description" => "yum yum",
    "price" => "10.50",
    "currencyCode" => "USD",
    "sellerData" => "",
  )
);
$testToken = JWT::encode($payload, $sellerSecret);
?>

I have two questions:

1. why do I see this error?... Uh oh. There was a problem. We couldn't complete your purchase because of a technical issue. Details of the problem below:Unfortunately, we could not confirm your purchase with the merchant's server. Your order has been canceled. Please contact the merchant if this problem continues.

2. How can this work if I have multiple items for sale? the example php above lets you buy a 'pizza for $10.50' how can I add another item like a 'hotdog for $2.99'?

ps: I have studied the following documentation:

https://developers.google.com/in-app-payments/docs/tutorial#4

https://developers.google.com/in-app-payments/docs/jsreference#jwt

https://developers.google.com/in-app-payments/docs/postback

Thank you for your time.

//update!

postback.php: require_once 'JWT.php';

JWT.php: $json = json_encode($input, JSON_UNESCAPED_SLASHES);

Uh oh. There was a problem. We couldn't complete your purchase because of a technical issue. Details of the problem below: Unfortunately, we could not confirm your purchase with the merchant's server. Your order has been canceled. Please contact the merchant if this problem continues.

Answer 1

You're supposed to decode the raw encoded jwt data sent to your postback.php. In bare minimum your postback.php should look something like below (assuming your postback.php is hosted on apache server). Hope this helps

<?php
require_once(dirname(__FILE__) . "JWT.php");

$response = isset($HTTP_RAW_POST_DATA) ?
    $HTTP_RAW_POST_DATA : file_get_contents("php://input");
$response = substr_replace($response, "", 0, 4);   //remove "jwt=" from raw http data
$response = JWT::decode($response, "your secret key here");
print_r($response->response);
?>

Answer 2

is your postback.php accessible without a .htaccess password and username? I had that for a while - drove me nuts... until i figured realized that my postback.php was password protected -.-

Answer 3

to make a hotdog additionally do this:

<?php
$cake_payload = array(
  "iss" => $sellerIdentifier,
  "aud" => "Google",
  "typ" => "google/payments/inapp/item/v1",
  "exp" => time() + 3600,
  "iat" => time(),
  "request" => array (
    "name" => "cake",
    "description" => "yum yum",
    "price" => "10.50",
    "currencyCode" => "USD",
    "sellerData" => "",
  )
);
$hotdog_payload = array(
  "iss" => $sellerIdentifier,
  "aud" => "Google",
  "typ" => "google/payments/inapp/item/v1",
  "exp" => time() + 3600,
  "iat" => time(),
  "request" => array (
    "name" => "hotdog",
    "description" => "yum yum",
    "price" => "5.99",
    "currencyCode" => "USD",
    "sellerData" => "",
  )
);

$cake_token = JWT::encode($cake_payload, $sellerSecret);
$hotdog_token = JWT::encode($hotdog_payload, $sellerSecret);
?>

pass both to a separate purchase() function in javascript (so purchase_hotdog() and purchase_cake()

Answer 4

Your example worked perfectly @Pawan. Thanks. The only change I needed was on the path to JWT.php.

I now use

require_once(dirname(FILE) . "/lib/JWT.php");

Paul