Consistent Secure Google Play In-app Purchase Scenario With Own Web Server

I've read several times all the docs in the Android Developer Guide and became familiar with nice Google presentation Evading Pirates and Stopping Vampires Finally I tried to imple

Solution 1:

There is no programmatic way to request a refund. The user has to contact you (by email, etc.) and you can refund their purchase in the developer console. After the refund is processed, the app will get a signed PURCHASE_STATE_CHANGED notification (broadcast) with the new order status (refunded). You can forward this to your server for verification, just as with new purchases and change the order status accordingly. You shouldn't care about what request the nonce is tied to, just check that it is indeed one your generated (Cf. Dungeons sample). If you are doing this on a server, you would typically search your DB to check if the nonce you previously generated is there.