Skip to main content
meek128
New Participant
December 8, 2022

Possible error in IAP S2S API documentation

In the IAP S2S API documentation ( https://developer.oculus.com/documentation/unity/ps-iap-s2s/ ), it says we need the app access token and the app id to verify entitlement of purchased items, which does not contain any user identification information.

curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "sku=$SKU" https://graph.oculus.com/$APP_ID/verify_entitlement

I tested the API endpoint with several combination of data, and it seems we need to send the user access token instead of the app access token to check entitlement (the response says DUC related document should be filed beforehand, which is expected).

I would like to clarify two things:

1. Should we send the user access token to the IAP S2S API to verify entitlement of an item?

2. If 1 is correct, should the secure server acquire user access tokens from game clients?

Thanks in advance.

      This topic has been closed for replies.

      1 reply

      WangShi
      WangShi
      Participant
      September 5, 2023

      yes, it is wrong, and I tried this like below, it works:

      curl -d "access_token=OC|$APP_ID|$APP_SECRET" -d "sku=$SKU" -d "user_id=$user_id" https://graph.oculus.com/$APP_ID/verify_entitlement

       the request must post user id.

      Terms & ConditionsAccessibility statement