Mobile IAP (iOS / Android SDK)

Applies to	Games selling through the Alogame mobile SDK (Apple / Google billing)
Endpoints	createOrder_url, exchange_url
Signature	MD5, Signature header, timestamp in seconds
Errors	HTTP status codes

For games using the Alogame mobile SDK (showPayment / purchaseAndVerify), the flow is:

The mobile SDK handles character selection client-side (passing role_id and server_id in the purchase request). Alogame verifies the receipt directly with Apple/Google, then calls your game server to create the order and deliver the item. No payment provider IPN is involved.

API 1 — Create Order

Called after Alogame verifies the Apple/Google receipt. Your server creates a local order record and returns a partner order code.

Method: POST
Path: full static URL as registered with Alogame Operations (same createOrder_url as web flow)

Request body — differs from web payment (extra fields for mobile context):

Field	Type	Description
order_id	string	Store transaction ID (Apple: transaction_id, Google: orderId)
uid	string	Character UID from game (passed by SDK as role_id)
productId	string	Your own product ID, exactly as you submitted it to Alogame
serverId	string	Game server ID (passed by SDK as server_id)
price	string	Price of the package Alogame configured for this product
ext_info	string	Context forwarded from the SDK
timestamp	integer	Unix timestamp (seconds)

{
  "order_id": "2000001167262669",
  "uid": "100002078",
  "productId": "com.yourgame.pack1",
  "serverId": "9999",
  "price": "49000",
  "ext_info": "{}",
  "timestamp": 1778318138
}

Response — 201 Created

{
  "status": "success",
  "order_code": "260509161539010042"
}

Error responses

Status	Code	Meaning
401	SIGNATURE_INVALID	Signature check failed
409	ORDER_ALREADY_EXISTS	Duplicate order_id — return your existing order_code
404	PRODUCT_NOT_FOUND	Product does not exist
404	UID_NOT_FOUND	UID does not exist

Handle 409 as success

If Alogame retries and receives 409 ORDER_ALREADY_EXISTS, it will proceed using the original order_code. Return the original order_code in the 409 body if possible.

API 2 — Deliver Item (Payment Received)

Called immediately after createOrder succeeds. Grant the purchased item to the player.

Method: POST
Path: full static URL as registered with Alogame Operations (same exchange_url as web flow)

Request body — differs from web payment (includes order_id and price):

Field	Type	Description
order_code	string	Partner order code returned from createOrder
order_id	string	Store transaction ID (same as createOrder)
price	string	Product price (same as createOrder)
ext_info	string	Context forwarded from the SDK
timestamp	integer	Unix timestamp (seconds)

{
  "order_code": "260509161539010042",
  "order_id": "2000001167262669",
  "price": "49000",
  "ext_info": "{}",
  "timestamp": 1778318139
}

Response — 200 OK

{
  "processingStatus": "completed"
}

Error responses

Status	Code	Meaning
401	SIGNATURE_INVALID	Signature check failed
404	ORDER_CODE_NOT_FOUND	order_code does not exist
409	PAYMENT_ALREADY_PROCESSED	Already delivered — safe for Alogame to ignore

Idempotency required

Alogame may retry this call on timeout or network failure. Your server must deduplicate on order_code and return 409 PAYMENT_ALREADY_PROCESSED for duplicates without re-granting the item.

---

Endpoint Registration

Submit both URLs to your Alogame Operations Manager, for production and dev/staging separately. Each URL is a complete static string — Alogame stores it as-is and calls it directly.

# Production
createOrder_url: https://api.yourgame.com/<your-path>
exchange_url:    https://api.yourgame.com/<your-path>

# Dev / Staging
createOrder_url: http://<dev-host>/<your-path>
exchange_url:    http://<dev-host>/<your-path>

Production must use HTTPS with a valid TLS certificate; dev/staging may use HTTP. Alogame routes to the correct environment with no SDK or client config change.

For an expub (Exclusive/Direct-publishing) game, these are the same two URLs used by Web Payment — Expub's web top-up flow — register them once, shared by both.

---

Implementation checklist

• Submitted createOrder_url and exchange_url (production + dev/staging) to Alogame Operations
• Production endpoints use HTTPS with a valid TLS certificate
• createOrder_url: creates order record from { order_id, uid, productId, serverId, price, ext_info, timestamp }; returns status: success + order_code; returns 409 for duplicate order_id
• exchange_url (paymentReceived): grants item from { order_code, order_id, price, ext_info, timestamp }; returns processingStatus: completed; returns 409 for duplicate order_code
• Both APIs: verify Signature header; reject if |now − timestamp| > 600s
• Delivery logged with order_code, uid, productId for CS lookup