| page.title=Licensing Overview |
| parent.title=Application Licensing |
| parent.link=index.html |
| @jd:body |
| |
| |
| <div id="qv-wrapper"> |
| <div id="qv"> |
| |
| <h2>Quickview</h2> |
| <ul> |
| <li>Licensing allows you to verify your app was purchased from Google Play</li> |
| <li>Your app maintains control of how it enforces its licensing status</li> |
| <li>The service is free for all developers who publish on Google Play</li> |
| </ul> |
| |
| <h2>In this document</h2> |
| <ol> |
| <li><a href="#Secure">License Responses are Secure</a></li> |
| <li><a href="#LVL">Licensing Verification Library</a></li> |
| <li><a href="#Reqs">Requirements and Limitations</a></li> |
| <li><a href="#CopyProtection">Replacement for Copy Protection</a></li> |
| </ol> |
| |
| </div> |
| </div> |
| |
| |
| <p>Google Play Licensing is a network-based service that lets an application query a trusted |
| Google Play licensing server to determine whether the application is licensed to the current |
| device user. The licensing service is based on the capability of the Google Play licensing server |
| to determine whether a given user is licensed to use a given application. Google Play considers a |
| user to be licensed if the user is a recorded purchaser of the application.</p> |
| |
| <p>The request starts when your application makes a request to a service hosted by |
| the Google Play client application. The Google Play application then sends a request to |
| the licensing server and receives the result. The Google Play application sends |
| the result to your application, which can allow or disallow further use of the |
| application as needed.</p> |
| |
| <p class="note"><strong>Note:</strong> If a paid application has been uploaded |
| to Google Play, but saved only as a draft application (the app is |
| unpublished), the licensing server considers all users to be licensed users of |
| the application (because it's not even possible to purchase the app). This |
| exception is necessary in order for you to perform testing of your licensing |
| implementation.</p> |
| |
| <div class="figure" style="width:469px"> |
| <img src="{@docRoot}images/licensing_arch.png" alt=""/> |
| <p class="img-caption"><strong>Figure 1.</strong> Your application initiates a |
| license check through the License Verification Library and the Google Play |
| client, which handles communication with the Google Play server.</p> |
| </div> |
| |
| |
| <p>To properly identify the user and determine the license status, the licensing server requires |
| information about the application and user—your application and the Google Play client work |
| together to assemble the information and the Google Play client passes it to the server. </p> |
| |
| <p>To help you add licensing to your application, the Android SDK provides a downloadable set of |
| library sources that you can include in your application project: the Google Market |
| Licensing package. The License Verification Library (LVL) is a library you can add to your |
| application that |
| handles all of the licensing-related communication with the Google Play licensing service. With |
| the LVL added to your application, your application can determine its licensing status for the |
| current user by simply calling a method and implementing a callback that receives the status |
| response.</p> |
| |
| <p>Your application does not query the licensing server |
| directly, but instead calls the Google Play client over remote IPC to |
| initiate a license request. In the license request:</p> |
| |
| <ul> |
| <li>Your application provides: its package name, a nonce that is later used to |
| validate any response from the server, and a callback over which the |
| response can be returned asynchronously.</li> |
| <li>The Google Play client collects the necessary information about the user and the device, |
| such as the device's primary Google account username, IMSI, and other |
| information. It then sends the license check request to the server on behalf of |
| your application.</li> |
| <li>The Google Play server evaluates the request using all available information, attempting |
| to establish the user's identity to a sufficient level of confidence. The server |
| then checks the user identity against purchase records for your application and |
| returns a license response, which the Google Play client returns to your |
| application over the IPC callback.</li> |
| </ul> |
| |
| <p>You can choose when, and how often, you want your application to check its |
| license and you have full control over how it handles the response, verifies the |
| signed response data, and enforces access controls.</p> |
| |
| <p>Notice that during a license check, your application does not manage any |
| network connections or use any licensing related APIs in the Android platform.</p> |
| |
| |
| |
| |
| <h2 id="Secure">License Responses are Secure</h2> |
| |
| <p>To ensure the integrity of each license query, the server signs the license |
| response data using an RSA key pair that is shared exclusively between the Google Play |
| server and you.</p> |
| |
| <p>The licensing service generates a single licensing key pair for each |
| application and exposes the public key in your application's |
| <strong>Services & APIs</strong> page in the Developer Console. You must copy |
| the public key from the Developer Console and embed it in your application |
| source code. The server retains the private key internally and uses it to sign |
| license responses for the applications you publish with that account.</p> |
| |
| <p>When your application receives a signed response, it uses the embedded public |
| key to verify the data. The use of public key cryptography in the licensing |
| service makes it possible for the application to detect responses that have been |
| tampered with or that are spoofed.</p> |
| |
| |
| |
| |
| <h2 id="LVL">Licensing Verification Library</h2> |
| |
| <p>The Android SDK provides a downloadable package called the Google Market Licensing package, |
| which includes the License Verification Library (LVL). The LVL greatly simplifies the process of |
| adding licensing to your application and helps ensure a more secure, robust implementation for your |
| application. The LVL provides internal classes that handle most of the standard operations of a |
| license query, such as contacting the Google Play client to initiate a license request and |
| verifying and validating the responses. It also exposes interfaces that let you easily plug in your |
| custom code for defining licensing policy and managing access as needed by your application. The key |
| LVL interfaces are: </p> |
| |
| <dl> |
| <dt>{@code Policy}</dt> |
| <dd>Your implementation determines whether to allow access to the |
| application, based on the license response received from the server and any |
| other data available (such as from a backend server associated with your |
| application). The implementation can evaluate the various fields of the license |
| response and apply other constraints, if needed. The implementation also lets |
| you manage the handling of license checks that result in errors, such as network |
| errors.</dd> |
| |
| <dt>{@code LicenseCheckerCallback}</dt> |
| <dd>Your implementation manages access to the |
| application, based on the result of the {@code Policy} object's handling of the license |
| response. Your implementation can manage access in any way needed, including |
| displaying the license result in the UI or directing the user to purchase the |
| application (if not currently licensed).</dd> |
| </dl> |
| |
| |
| <p>To help you get started with a {@code Policy}, the LVL provides two fully complete |
| {@code Policy} implementations that you can use without modification or adapt to your |
| needs:</p> |
| |
| <dl> |
| <dt><a href="adding-licensing.html#ServerManagedPolicy">{@code ServerManagedPolicy}</a></dt> |
| <dd>A flexible {@code Policy} |
| that uses settings provided by the licensing server to manage response caching |
| and access to the application while the device is offline (such as when the |
| user is on an airplane). For most applications, the use of |
| {@code ServerManagedPolicy} is highly recommended.</dd> |
| |
| <dt><a href="adding-licensing.html#StrictPolicy">{@code StrictPolicy}</a></dt> |
| <dd>A restrictive {@code Policy} that |
| does not cache any response data and allows the application access <em>only</em> |
| when the server returns a licensed response.</dd> |
| </dl> |
| |
| <p>The LVL is available as a downloadable package of the Android SDK. The |
| package includes both the LVL itself and an example application that shows how |
| the library should be integrated with your application and how your application |
| should manage response data, UI interaction, and error conditions. </p> |
| |
| <p>The LVL sources are provided as an Android <em>library project</em>, which |
| means that you can maintain a single set of library sources and share them |
| across multiple applications. A full test environment is also available through |
| the SDK, so you can develop and test the licensing implementation in your |
| applications before publishing them, even if you don't have access to a |
| physical device.</p> |
| |
| |
| |
| |
| <h2 id="Reqs">Requirements and Limitations</h2> |
| |
| <p>Google Play Licensing is designed to let you apply license controls to |
| applications that you publish through Google Play. The service is not |
| designed to let you control access to applications that are not published |
| through Google Play or that are run on devices that do not offer the Google |
| Play client. </p> |
| |
| <p>Here are some points to keep in mind as you implement licensing in your |
| application: </p> |
| |
| <ul> |
| <li>An application can use the service only if the Google Play client is |
| installed on its host device and the device is running Android 1.5 (API level 3) |
| or higher.</li> |
| <li>To complete a license check, the licensing server must be accessible over |
| the network. You can implement license caching behaviors to manage access to your application when |
| there is no network connectivity. </li> |
| <li>The security of your application's licensing controls ultimately relies on |
| the design of your implementation itself. The service provides the building |
| blocks that let you securely check licensing, but the actual enforcement and |
| handling of the license are factors are up to you. By following the best |
| practices in the following documents, you can help ensure that your implementation will be |
| secure.</li> |
| <li>Adding licensing to an application does not affect the way the application |
| functions when run on a device that does not offer Google Play.</li> |
| <li>You can implement licensing controls for a free app, but only if you're using the service to |
| provide <a |
| href="{@docRoot}google/play/expansion-files.html">APK expansion files</a>.</li> |
| </ul> |
| |
| |
| |
| <h2 id="CopyProtection">Replacement for Copy Protection</h2> |
| |
| <p>Google Play Licensing is a flexible, secure mechanism for controlling |
| access to your applications. It effectively replaces the Copy Protection |
| mechanism (no longer supported) that was previously offered on Google Play and |
| gives you wider distribution potential for your applications. </p> |
| |
| <p>Licensing lets you move to a license-based model that is enforceable on |
| all devices that have access to Google Play. Access is not bound to the |
| characteristics of the host device, but to your |
| application on Google Play (through the app's public key) and the |
| licensing policy that you define. Your application can be installed and |
| managed on any device on any storage, including SD card.</p> |
| |
| <p>Although no license mechanism can completely prevent all unauthorized use, |
| the licensing service lets you control access for most types of normal usage, |
| across all compatible devices, locked or unlocked, that run Android 1.5 or |
| higher version of the platform.</p> |
| |
| <p>To begin adding application licensing to your application, continue to <a |
| href="{@docRoot}google/play/licensing/setting-up.html">Setting Up for Licensing</a>.</p> |
| |
| |
| |
| |
| |
| |