Instant Games SDK v8.0: FBInstant.payments

• CLIENT_UNSUPPORTED_OPERATION
• PAYMENTS_NOT_INITIALIZED
• NETWORK_FAILURE

FBInstant.payments.getCatalogAsync().then(function (catalog) {
  console.log(catalog); // [{productID: '12345', ...}, ...]
});

• CLIENT_UNSUPPORTED_OPERATION
• PAYMENTS_NOT_INITIALIZED
• INVALID_PARAM
• NETWORK_FAILURE
• INVALID_OPERATION
• USER_INPUT

FBInstant.payments.purchaseAsync({
  productID: '12345',
  developerPayload: 'foobar',
}).then(function (purchase) {
  console.log(purchase);
  // {productID: '12345', purchaseToken: '54321', developerPayload: 'foobar', ...}
});

• CLIENT_UNSUPPORTED_OPERATION
• PAYMENTS_NOT_INITIALIZED
• NETWORK_FAILURE

FBInstant.payments.getPurchasesAsync().then(function (purchases) {
  console.log(purchase);
  // [{productID: '12345', ...}, ...]
});

• CLIENT_UNSUPPORTED_OPERATION
• PAYMENTS_NOT_INITIALIZED
• INVALID_PARAM
• NETWORK_FAILURE

FBInstant.payments.consumePurchaseAsync(purchaseToken).then(function () {
  console.log('Purchase consumed. Player can now buy this product again.');
}).catch(function (error) {
  console.error('Failed to consume purchase:', error);
});

FBInstant.payments.onReady(function () {
  console.log('Payments Ready!')
});

1. Split the signature into two parts delimited by the ‘.’ character.
2. Decode the first part (the encoded signature) with base64url encoding.
3. Decode the second part (the response payload) with base64url encoding, which should be a string representation of a JSON object that has the following fields: algorithm - always equals to HMAC-SHA256 issued_at - a unix timestamp of when this response was issued app_id - The game’s application ID is_consumed - Whether the purchase has been consumed by the player. payment_action_type - The current status of the purchase payment_id - The identifier for the purchase transaction product_id - The product’s game-specified identifier purchase_price - Contains the local amount and currency associated with the purchased item purchase_token - A token representing the purchase that may be used to consume the purchase purchase_time - Unix timestamp of when the purchase occurred developer_payload - A developer-specified string, provided during the purchase of the product
4. Hash the whole response payload string using HMAC SHA-256 and your app secret and confirm that it is equal to the encoded signature.
5. You may also wish to validate the issued_at timestamp in the response payload to ensure the request was made recently.