Error 401 - Google-api-php-client verifing by server Android inapppurchase

[Sergio Segarra]

I need to verify on my server each Android purchase that was made before by user in my Android APP. I though that working with google-api-php-client it would be easy the authentication and managing of the token in server. But there aren't any sample, and yesterday Google published new version 0.6.3 providing in-app-purchases service.

I followed -> *code.google.com/p/google-api-php-client/wiki/OAuth2#Service_Accounts*

On my code.google.com/apis/console/ I pushed on, "Google Play Android Developer API" and I configured the "service account" in API Access.

From Android client APP, server recives the PACKAGE_NAME, PRODUCT_ID and purchase TOKEN.

My server code is the following:

require_once '../../src/Google_Client.php';
require_once '../../src/contrib/Google_AndroidpublisherService.php';

// Set your client id, service account name, and the path to your private key.
// For more information about obtaining these keys, visit:
// https://developers.google.com/console/help/#service_accounts
const CLIENT_ID = 'asdf.apps.googleusercontent.com';
const SERVICE_ACCOUNT_NAME = 'as...@developer.gserviceaccount.com';

// Make sure you keep your key.p12 file in a secure location, and isn't
// readable by others.
const KEY_FILE = '../../asdf/privatekey.p12';;

$client = new Google_Client();
$client->setApplicationName({APP_PACKAGE_NAME});

// Set your cached access token. Remember to replace $_SESSION with a
// real database or memcached.
session_start();
if (isset($_SESSION['token'])) {
 $client->setAccessToken($_SESSION['token']);
}

// Load the key in PKCS 12 format (you need to download this from the
// Google API Console when the service account was created.
$key = file_get_contents(KEY_FILE);
$client->setAssertionCredentials(new Google_AssertionCredentials(
    SERVICE_ACCOUNT_NAME,
    array('https://www.googleapis.com/auth/androidpublisher'),
    $key)
);

$client->setClientId(CLIENT_ID);
$service = new Google_AndroidPublisherService($client);
$res = $service->inapppurchases->get({APP_PACKAGE_NAME},{APP_PACKAGE_NAME.PRODUCT_ID}, {PURCHASE_TOKEN});
var_dump($res);

The error showed is:

Google_ServiceException: Error calling GET https://www.googleapis.com/androidpublisher
/v1.1/applications/{APP_PACKAGE_NAME}/inapp/{APP_PACKAGE_NAME.PRODUCT_ID}/purchases
/{PURCHASE_TOKEN}: (401) This developer account does not own the application. in 
/.../google-api-php-client/src/io/Google_REST.php on line 66 Call Stack: 0.0201 
266376 1. {main}() ............

Token is correct, and I'm working with the same account in Google API Console(https://code.google.com/apis/console) and Google Developer Console (https://play.google.com/apps/publish/). I'm only using Service account api, and don't working with Client ID for web applications, and Simple API Access. For security I changed here some code values.

Could somebody help me to know what's wrong on my purchase server verification using Google API please? How I know the owner of my app? Have something to do with Google Apis new project, project domain, project number, project ID, etc...?

[Sergio Segarra]

I think my problem was because I was trying to use Service Accounts with a Google Apps Gmail own account ( non @gmail.com account ).
I had to delegate domain-wide authority to my service account.
And I had to instantiate a Android Publisher Service as follows: ( only founded in Google Api Drive documentation ).
I added "sub" parameter programmatically in Google_AssertionCredentials like follows:
$auth = new Google_AssertionCredentials(
    SERVICE_ACCOUNT_NAME,
    'https://www.googleapis.com/auth/androidpublisher',
    $key);
$auth->sub = "my...@email.com";
$client->setAssertionCredentials($auth);

The documentation in Google Play Android Developer API is very poor, and Google Support doesn't help, they redirects you to documentation. Google PHP developers even don't know how Service Accounts works.
In spite of having found the answer by myself, Google needs to improve all new Google Play In-app Billing API version 3.