# Test Purchases and Security

## Overview <a href="#testpurchasesandsecurity.-overview" id="testpurchasesandsecurity.-overview"></a>

ONE store supports the payment test of in-app products in a development environment (hereafter called 'Sandbox') or commercial billing environment (hereafter called the 'commercial test').

Sandbox is a virtual billing environment, not the commercial billing environment. If you choose a billing failure or success as you wish on the billing screen, Sandbox transfers the response relevant to your choice.

The commercial test will process the billing for in-app products in the commercial billing environment and transfer the billing result.

If you pay in the commercial test environment and do not cancel the billing, charges may incur. You must cancel the billing after completing the billing test.

{% hint style="warning" %}
* You must conduct a sandbox test at least once on the OS where you intend to distribute the product.
* For OGL AAB/APK, sandbox testing can be conducted in the Android environment.
* To perform a test in the Sandbox and commercial environments, ONE store ID must be registered as a test ID in advance.\
  Please be aware that if you perform the test with an unregistered ONE store ID, you will not be able to perform the test in Sandbox and the actual payment will be processed and charged in the commercial test environment.&#x20;
* ONE store is not liable for any payment made through the test ID. Please proceed with the management of the test ID and the billing test under the supervision of the manager of the developer.
{% endhint %}

## IAP Test Screen <a href="#testpurchasesandsecurity.-iaptestscreen" id="testpurchasesandsecurity.-iaptestscreen"></a>

On the "In-App Info" screen, click the "Payment Test" button to access the in-app payment test screen.

On this screen, you can manage test IDs or check payment test history.

## Register/Manage Test ID <a href="#testpurchasesandsecurity.-register-managetestid" id="testpurchasesandsecurity.-register-managetestid"></a>

You must register a test ID to perform the in-app billing test in the development and commercial environments.

If you select the 'Test ID mgmt.' tab on the in-app billing test screen, you will be moved to the test ID management screen.

The test ID is the same as ONE store ID, and you can register the test ID after checking if you have the ID registered on ONE store.

If you are not registered as a ONE store member, run the ONE store app and generate a ONE store ID for the test and then register this ID as the test ID.

### Register test ID <a href="#testpurchasesandsecurity.-registertestid" id="testpurchasesandsecurity.-registertestid"></a>

* Search for the ONE store ID to be used as a test ID.
* After checking the ONE store ID, select the billing environment (Sandbox or commercial test) to perform the billing test with this test ID.
*   Enter references, if necessary, and register the test ID by clicking on the registration button.&#x20;

    Only one test ID can be selected for a billing environment. The billing environment settings can be changed at any time.
* With the registered test ID, you can set up the environment in which you will perform the billing test.
* When you change the test ID billing environment, you must click on the 'Save' button to save the new settings.

### **Delete test** **ID**

* If the test ID is no longer valid, you can remove it.
* You can delete the test IDs individually by clicking on the Remove button, or you can remove them in a batch after ticking the multiple test IDs and clicking on the Delete the Selected Test IDs button.

### **Export test** **ID**

* If you use the same test ID in common for multiple apps, you can export the test ID to other apps.
* The check box will be activated only for the apps, which can be exported. Select the apps to which the test IDs will be exported and then click on the 'Export' button

## Payment Test in the Sandbox Environment (required)  <a href="#testpurchasesandsecurity.-paymenttestinthesandboxenvironment-required" id="testpurchasesandsecurity.-paymenttestinthesandboxenvironment-required"></a>

### Sandbox Testing for Payment and Validation  <a href="#testpurchasesandsecurity.-sandboxtestingforpaymentandvalidation" id="testpurchasesandsecurity.-sandboxtestingforpaymentandvalidation"></a>

Sandbox is a virtual billing environment (not a commercial billing environment). If you select the desired response from the billing screen that shows the billing failure or success, you will receive the response results.

You can search the history of the billing made in Sandbox at the 'Sandbox' tab of the in-app billing test screen, and the billing cancellation is also available.

Each OS requires at least one test in Sandbox. If testing is not performed, verification requests cannot be made.

> Testing by country/region is not required. You can test in any country/region that is convenient for you.

If distributing AAB/APK through ONE Game Loop, refer to Android OS test results and conduct testing in the Android environment.

The information on the test environment (commercial & Sandbox) will be maintained in the memory while being connected to OSS. If you have changed the test environment of the test ID through the Developer Center, you must restart the app.

{% hint style="info" %}
Sandbox billing test is only available when the test ID is set to Sandbox.
{% endhint %}

### Sandbox Testing for Subscription Products <a href="#testpurchasesandsecurity.-sandboxtestingforsubscriptionproducts" id="testpurchasesandsecurity.-sandboxtestingforsubscriptionproducts"></a>

If the payment cycle is set to match the actual time when developing subscription products, the test requires too much time.\
Therefore, in the sandbox environment, we facilitate smoother testing by adjusting the time required for each subscription cycle.\
The time flow within Sandbox for each billing cycle and function is as follows:

| Billing Cycle  | Time (Sandbox)  |
| -------------- | --------------- |
| 1 week         | 5 minutes       |
| 1 month        | 5 minutes       |
| 3 months       | 10 minutes      |
| 6 months       | 15 minutes      |
| 1 year         | 30 minutes      |

| Function                                                  |  Time (Sandbox) |
| --------------------------------------------------------- | --------------- |
| Free subscription                                         | 3 minutes       |
| Grace period                                              | 5 minutes       |
| Account on hold                                           | 10 minutes      |
| <p>Price change<br>(7 days)</p>                           | 5 minutes       |
| <p>Duration of agreement to price change<br>(30 days)</p> | 5 minutes       |

## Billing Test in Commercial Environment (optional) <a href="#testpurchasesandsecurity.-billingtestincommercialenvironment-optional" id="testpurchasesandsecurity.-billingtestincommercialenvironment-optional"></a>

The commercial test performs the billing of the corresponding in-app in the commercial billing environment and sends the billing result.

You can search the history of the billing made in the commercial test at the Commercial Test tab of the in-app billing test screen, and the billing cancellation is also available.

Unless the billing is canceled in the commercial test environment, it might lead to a charge, therefore the billing must be canceled after the billing test.

{% hint style="info" %}
* The billing test is available only when the test ID is set to the commercial test in the commercial test environment.
* If a test is conducted using a ONE store ID that has not been registered as test ID, the test in Sandbox will not be available. In the commercial test environment, the billing will be performed officially, as not as a test, thereby leading to a charge.
* If the actual commercial billing has been made, immediately send the billing details to ONE store and request the billing cancellation.
{% endhint %}

## Check In-App Billing Test Result and Cancel Billing <a href="#testpurchasesandsecurity.-checkin-appbillingtestresultandcancelbilling" id="testpurchasesandsecurity.-checkin-appbillingtestresultandcancelbilling"></a>

You can check the billing status of the in-app billing test history and cancel the billing.\
You can search the history of the billing made in Sandbox at the 'Sandbox' tab, and the history of the billing made in the commercial test at the 'Commercial Test' tab of the in-app billing test screen.

### Sandbox environment <a href="#testpurchasesandsecurity.-sandboxenvironment" id="testpurchasesandsecurity.-sandboxenvironment"></a>

* Provides the history of the billing tested in the Sandbox environment.
* You can search the paid in-app information and billing status, or cancel the billing.&#x20;

### Commercial test environment <a href="#testpurchasesandsecurity.-commercialtestenvironment" id="testpurchasesandsecurity.-commercialtestenvironment"></a>

* Provides the history of the billing tested in the commercial test environment.
* You can search the paid in-app information and billing status, or cancel the billing.

## Security and Authentication <a href="#testpurchasesandsecurity.-securityandauthentication" id="testpurchasesandsecurity.-securityandauthentication"></a>

### Security of In-App Purchase (IAP) <a href="#testpurchasesandsecurity.-securityofin-apppurchase-iap" id="testpurchasesandsecurity.-securityofin-apppurchase-iap"></a>

* The ONE store IAP uses a method of checking the signature's validity for safe billing by confirming whether data has been forged or falsified.Mobile apps are exposed to the threat of multiple attacks, and therefore it is recommended to perform signature authentication in the developer's app or server to minimize such a risk.The following indicates what the developer must prepare additionally for safer IAP.
* Using the developer's server
  * To prevent attacks using APK Reverse Engineering, etc., store the implementation code and public key, etc. in the server, and perform authentication.
  * In addition, when you store the purchase information, it is better to use the developer server's storage rather than the terminal's storage and then to confirm the permission to use the item.&#x20;
* Using a modified code
  * The sample code provided by ONE store is open to many people, and therefore it is recommended to revise the code before using it instead of using the original one. Using the original code may lead to exposure issues or attacks.
  * It is better to protect the code related to the billing by using code obfuscation tools, including Proguard.
  * Even with the public key, it is not a safe way to put a plain string inside the app code. It is safe to prevent easy exposure by XORing with other strings to block the attackers from easy access.&#x20;
* Using the 'developerPayload' field at the request of billing
  * Developers can put random information in the'developerPayload'field upon payment request and receive it again at the time when the payment is completed.Verification of payment results can be made more secure by putting in this field additional security verification data combined with timestamp.&#x20;

### How to authenticate ONE store IAP  <a href="#testpurchasesandsecurity.-howtoauthenticateonestoreiap" id="testpurchasesandsecurity.-howtoauthenticateonestoreiap"></a>

* Prepare authentication
  * Use the RSA approach for the key algorithms for authentication, and use 'SHA512withRSA' as the algorithm for signature.\
    For the signature verification key, refer to 'Check License Key (public key) & OAuth Credentials' in the [Pre-Preparations](../old-version/v19/pre-preparations) page.\
    Store and use the signature verification key appropriately depending on where the authentication is performed, such as the terminal or server.
* Signature authentication sample code
  * SDK provides the 'AppSecurity' utility class and you can perform the signature authentication by using the 'verifyPurchase' method.\
    If the developer wants to directly perform the signature authentication without using the SDK, he/she is required to implement the code in person that performs the same function as 'AppSecurity'.\
    For details about the implementation, refer to the sample distributed with the SDK library.
