谷歌支付验证2

https://developers.google.com/android-publisher/authorization

Authorization

This section contains instructions specific to the Google Play Developer API. See thefull OAuth2 documentation for more details.

Initial configuration

Access to the Google Play Android Developer API is authenticated using the OAuth 2.0 Web Server flow. Before you can use the API, you will need to set up an APIs Console project, create a client ID and generate a refresh token.

Creating an APIs Console project

1. Go to the APIs Console and log in with your Google Play Developer Console account.
2. Select Create project.
3. Go to Services in the left-hand navigation panel.
4. Turn the Google Play Android Developer API on.
5. Accept the Terms of Service.
6. Go to API Access in the left-hand navigation panel.
7. Select Create an OAuth 2.0 client ID.
   • On the first page, you will need to fill in the product name, but a logo is not required. Note that your end users will not see the product name.
   • On the second page, select web application and set the redirect URI and Javascript origins. Both of these settings can be changed later.
8. Select Create client ID.

Generating a refresh token

1. While logged in with your Google Play Developer Console account, go to the following URI:

   https://accounts.google.com/o/oauth2/auth?scope=https://www.googleapis.com/auth/androidpublisher&response_type=code&access_type=offline&redirect_uri=...&client_id=...

   Note: the redirect_uri parameter must match the value registered with the client ID exactly, including the trailing backslash, if present.
2. Select Allow access when prompted.
3. The browser will be redirected to your redirect URI with a code parameter, which will look similar to4/eWdxD7b-YSQ5CNNb-c2iI83KQx19.wp6198ti5Zc7dJ3UXOl0T3aRLxQmbwI.
4. Exchange this code for an access and refresh token pair by sending a POST request tohttps://accounts.google.com/o/oauth2/token with the following fields set:

   grant_type=authorization_codecode=<the code from the previous step>client_id=<the client ID token created in the APIs Console>client_secret=<the client secret corresponding to the client ID>redirect_uri=<the URI registered with the client ID>

   A successful response will contain your tokens in JSON format:

   {  "access_token" : "ya29.ZStBkRnGyZ2mUYOLgls7QVBxOg82XhBCFo8UIT5gM",  "token_type" : "Bearer",  "expires_in" : 3600,  "refresh_token" : "1/zaaHNytlC3SEBX7F2cfrHcqJEa3KoAHYeXES6nmho"}

Accessing the API

Once you have generated the client credentials and refresh token, your servers can access the API without an active login or human intervention.

Using the access token

Servers can make calls to the API by appending the access token as a query parameter:

https://www.googleapis.com/androidpublisher/v1/...?access_token=...

Alternatively, the access token can be set in the Authorization header of the request.

Using the refresh token

Each access token is only valid for a short time. Once the current access token expires, the server will need to use the refresh token to get a new one. To do this, send a POST request tohttps://accounts.google.com/o/oauth2/token with the following fields set:

grant_type=refresh_tokenclient_id=<the client ID token created in the APIs Console>client_secret=<the client secret corresponding to the client ID>refresh_token=<the refresh token from the previous step>

A successful response will contain another access token:

{  "access_token" : "ya29.AHES3ZQ_MbZCwac9TBWIbjW5ilJkXvLTeSl530Na2",  "token_type" : "Bearer",  "expires_in" : 3600,}

The refresh token thus allows a web server continual access to the API without requiring an active login to a Google account.