Connect Google Play

Google setup combines a Play-enabled service account for authoritative purchase reads and a separate authenticated Pub/Sub push path for real-time developer notifications (RTDN). The Play credential and the Pub/Sub push identity have different jobs.

Before you start

Create the app and products in Play Console and enter the exact package name in CherrySub. Prepare a Google Cloud project. The setup operator needs permission to enable APIs and create service accounts/keys in that project, plus the Play authority to manage users and app grants.

For automation, the current CLI requires an organization-provided Desktop app OAuth client. A CherrySub-owned verified Google OAuth client is not bundled. Download the Desktop client JSON from Google Cloud credentials, configure its audience/test users as needed, and keep it separate from the service-account JSON the command will generate.

Automated credential provisioning

cherrysub setup google APP_UUID --project PROJECT_UUID \
  --oauth-client ./google-desktop-client.json \
  --cloud-project my-cloud-project \
  --developer-account 1234567890123456789

--project is the CherrySub project. --cloud-project is Google's project ID. The Play developer account ID is the number after /developers/ in the Play Console URL; the CLI also accepts that full URL.

After local browser authorization with PKCE and a loopback callback, the CLI displays the target project, account, package, and service-account email. On confirmation it enables IAM and Android Publisher APIs, creates/reuses an app-specific cherrysub-* service account, grants package access, creates a key in memory, and uploads it to CherrySub.

The package permissions are app information, financial data, and order/subscription management. Existing permissions are retained. Temporary account-wide bootstrap access created by the flow is removed, and cleanup failure is reported. Organization policies blocking key creation are not changed automatically.

Upload an existing service account

Enable Android Publisher access and grant the service-account email the required app permissions in Play Console. In Google Cloud, create a JSON key for that service account. In CherrySub, use Integrations → Google Play → Upload credential.

Choose the service-account JSON, up to 64 KiB. CherrySub previews its account email before saving. An OAuth client JSON is a different file and is rejected by this uploader. The manual-paste alternative is available under Paste JSON instead.

The service-account JSON must name type: service_account, include client_email and private_key, and use https://oauth2.googleapis.com/token as token_uri. Store permission changes may take time to become usable; test an authoritative purchase read after setup.

Configure RTDN separately

Credential provisioning does not create RTDN infrastructure in this preview. The installation operator must supply an authenticated push path and the Play team must connect its topic.

1. Create a Pub/Sub topic for the intended environment and grant google-play-developer-notifications@system.gserviceaccount.com Pub/Sub Publisher on that topic.
2. Create a push subscription with the Pub/Sub message wrapper enabled. Its messageId is used for delivery idempotency.
3. Use this staging endpoint and exact OIDC audience: https://api-staging.cherrysub.com/ingest/google/rtdn.
4. Configure a user-managed push service-account identity. The installation's GOOGLE_PUBSUB_SERVICE_ACCOUNT must match the expected OIDC email; GOOGLE_PUBSUB_AUDIENCE must match the exact audience.
5. Grant the Pub/Sub service agent the required token-creation authority for that push identity and configure retry/dead-letter handling.
6. In the Play app's monetization setup, enter the fully qualified topic name projects/PROJECT_ID/topics/TOPIC_ID, save, and send a test notification.

Use Google's RTDN setup guide for the current console controls. Operators should follow self-hosting for the server configuration and a dedicated environment's retry/dead-letter settings.

The current ingress has a deployment-level expected Pub/Sub audience and push identity, not an independently configurable push identity per dashboard app. Coordinate that identity with the installation operator rather than assuming each newly generated Play service account can authenticate Pub/Sub pushes automatically.

Check purchase verification

A test RTDN is accepted as a notification event and does not prove purchase-token read access. Submit a real test purchase through your SDK. The backend fetches the authoritative subscription or one-time-product state and attributes its actual environment.

Use product_type: subscription for subscriptions, including prepaid plans, or one_time_product for in-app products. Pending purchases are not completed as paid purchases. The app's acknowledge/consume policy runs only after backend acceptance.

Recover a failed setup

For permission errors, check the selected Cloud project, Play developer account, package grant, and signed-in operator. For key-creation policy failures, use your organization's approved credential process. For an upload timeout, check masked connection status and the reported key ID before retrying or revoking an unused new key.

A missing Pub/Sub configuration fails notification ingress closed. A failed authoritative Play read does not become a successful purchase based only on the notification integer. CLI · Troubleshooting.

Import the Google product catalog

Products → Import from store → Google Play uses this app's connected service account. It reads subscriptions and modern one-time products through Android Publisher, preserving subscription base plan IDs. The account needs access to the exact Play app and its product catalog. Product listing performs no Play configuration writes.

Wait for all pages to load, search and select products, then preview the import. Leave access unmapped or optionally attach one existing level with a store-managed mapping. Existing product entries remain unchanged. Product sets and native offer-token selection are separate steps; an imported Google package can preserve its exact base plan in base_plan_id. Pricing, regional availability, purchase options, and offers remain Play configuration. Products · Migration.