In-App Purchases (IAP)

curl -i -X PUT "https://api.facebook.com/instant-games/catalog/{app-id}/items" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {app-id}|{app-token}" \
  -H "X-API-Version: 1.0.0" \
  -d '{
    "product_id": "coins_500",
    "product_title": "500 Gold Coins",
    "product_description": "A bundle of 500 gold coins to spend in the shop.",
    "product_type": "consumable",
    "product_price_amount": "0.99"
  }'

204 No Content

curl -i -X DELETE "https://api.facebook.com/instant-games/catalog/{app-id}/items/{product-id}" \
  -H "Authorization: Bearer {app-id}|{app-token}" \
  -H "X-API-Version: 1.0.0"

204 No Content

curl -i -X PUT "https://api.facebook.com/instant-games/catalog/{app-id}/items" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer {app-id}|{app-token}" \
  -H "X-API-Version: 2.0.0" \
  -d '{
    "product_id": "coins_500",
    "product_title": "500 Gold Coins",
    "product_description": "A bundle of 500 gold coins to spend in the shop.",
    "product_type": "consumable",
    "product_price_amount": "0.49",
    "region": "apac_tier_1"
  }'

curl -i -X DELETE "https://api.facebook.com/instant-games/catalog/{app-id}/items/{product-id}?region=apac_tier_1" \
  -H "Authorization: Bearer {app-id}|{app-token}" \
  -H "X-API-Version: 2.0.0"

curl -i -X GET "https://api.facebook.com/instant-games/catalog/{app-id}/items?region=apac_tier_1" \
  -H "Authorization: Bearer {app-id}|{app-token}" \
  -H "X-API-Version: 2.0.0"

[
  {
    "product_id": "coins_500",
    "product_title": "500 Gold Coins",
    "product_description": "A bundle of 500 gold coins to spend in the shop.",
    "product_type": "consumable",
    "price_amount_cents": 49,
    "price_currency_code": "USD",
    "region": "apac_tier_1"
  }
]

// Check if the payments API is supported on this platform
function isIAPAvailable() {
  const supportedAPIs = FBInstant.getSupportedAPIs();
  return supportedAPIs.includes('payments.getCatalogAsync');
}

FBInstant.payments.onReady(function () {
  console.log('Payments are ready.');
  // Now you can safely call getCatalogAsync, purchaseAsync, etc.
});

FBInstant.payments.getCatalogAsync().then(function (catalog) {
  catalog.forEach(function (product) {
    console.log('Product:', product.productID);
    console.log('  Title:', product.title);
    console.log('  Description:', product.description);
    console.log('  Price:', product.price);
    console.log('  Price Currency Code:', product.priceCurrencyCode);
    console.log('  Image URI:', product.imageURI);
  });
}).catch(function (error) {
  console.error('Failed to get catalog:', error);
});

FBInstant.payments.purchaseAsync({
  productID: 'coins_500',
  developerPayload: 'optional_custom_data',
}).then(function (purchase) {
  console.log('Purchase successful!');
  console.log('  Product ID:', purchase.productID);
  console.log('  Purchase Token:', purchase.purchaseToken);
  console.log('  Signed Request:', purchase.signedRequest);

  // IMPORTANT: Verify the purchase server-side before delivering content.
  verifyPurchaseOnServer(purchase.signedRequest).then(function () {
    // Deliver the purchased content to the player
    deliverCoins(500);

    // If the product is consumable, consume it so it can be purchased again
    return FBInstant.payments.consumePurchaseAsync(purchase.purchaseToken);
  }).then(function () {
    console.log('Purchase consumed successfully.');
  });
}).catch(function (error) {
  // Handle errors (player cancelled, network error, etc.)
  console.error('Purchase failed:', error.code, error.message);
});

FBInstant.payments.getPurchasesAsync().then(function (purchases) {
  purchases.forEach(function (purchase) {
    console.log('Unconsumed purchase:', purchase.productID);

    // Verify and deliver the content, then consume the purchase
    verifyPurchaseOnServer(purchase.signedRequest).then(function () {
      deliverProduct(purchase.productID);
      return FBInstant.payments.consumePurchaseAsync(purchase.purchaseToken);
    }).then(function () {
      console.log('Recovered purchase consumed:', purchase.productID);
    });
  });
}).catch(function (error) {
  console.error('Failed to get purchases:', error);
});

FBInstant.payments.consumePurchaseAsync(purchaseToken).then(function () {
  console.log('Purchase consumed. Player can now buy this product again.');
}).catch(function (error) {
  console.error('Failed to consume purchase:', error);
});

// 1. Check if IAP is available
if (!FBInstant.getSupportedAPIs().includes('payments.getCatalogAsync')) {
  console.log('IAP not available on this platform. Hiding store.');
  hideStoreUI();
  return;
}

// 2. Wait for payments to be ready
FBInstant.payments.onReady(function () {

  // 3. Recover any unconsumed purchases from previous sessions
  FBInstant.payments.getPurchasesAsync().then(function (purchases) {
    purchases.forEach(function (purchase) {
      recoverPurchase(purchase);
    });
  });

  // 4. Get the product catalog and display the store
  FBInstant.payments.getCatalogAsync().then(function (catalog) {
    displayStore(catalog);
  });
});

// 5. When the player taps a "Buy" button:
function onBuyButtonClicked(productID) {
  FBInstant.payments.purchaseAsync({
    productID: productID,
  }).then(function (purchase) {
    // 6. Verify the purchase on your server
    return verifyAndDeliver(purchase);
  }).then(function (purchase) {
    // 7. Consume the purchase (for consumable products)
    return FBInstant.payments.consumePurchaseAsync(purchase.purchaseToken);
  }).then(function () {
    // 8. Update the game UI
    updateStoreUI();
    showSuccessMessage('Purchase complete! Enjoy your items.');
  }).catch(function (error) {
    if (error.code === 'USER_INPUT') {
      // Player cancelled the purchase - this is normal, not an error
      console.log('Player cancelled the purchase.');
    } else {
      console.error('Purchase error:', error.code, error.message);
      showErrorMessage('Something went wrong. Please try again.');
    }
  });
}

<encoded_signature>.<encoded_payload>

const crypto = require('crypto');

function verifySignedRequest(signedRequest, appSecret) {
  const [encodedSignature, encodedPayload] = signedRequest.split('.');

  // Decode the signature
  const signature = Buffer.from(
    encodedSignature.replace(/-/g, '+').replace(/_/g, '/'),
    'base64'
  );

  // Compute the expected signature
  const expectedSignature = crypto
    .createHmac('sha256', appSecret)
    .update(encodedPayload)
    .digest();

  // Compare signatures securely
  if (!crypto.timingSafeEqual(signature, expectedSignature)) {
    throw new Error('Invalid signature');
  }

  // Decode and return the payload
  const payload = Buffer.from(
    encodedPayload.replace(/-/g, '+').replace(/_/g, '/'),
    'base64'
  ).toString('utf8');

  return JSON.parse(payload);
}

// Example: Check for durable purchases on game start
FBInstant.payments.getPurchasesAsync().then(function (purchases) {
  const ownedProducts = purchases.map(function (p) { return p.productID; });

  if (ownedProducts.includes('remove_ads')) {
    disableAds();
  }

  if (ownedProducts.includes('premium_skin_dragon')) {
    unlockSkin('dragon');
  }
});

FBInstant.payments.purchaseAsync({ productID: 'coins_500' })
  .then(function (purchase) {
    handleSuccessfulPurchase(purchase);
  })
  .catch(function (error) {
    switch (error.code) {
      case 'USER_INPUT':
        // Player chose to cancel - not an error
        break;
      case 'NETWORK_FAILURE':
        showMessage('Network error. Please check your connection and try again.');
        break;
      case 'INVALID_OPERATION':
      case 'CLIENT_UNSUPPORTED':
        showMessage('Purchases are not available on this device.');
        hideStoreUI();
        break;
      default:
        showMessage('Something went wrong. Please try again later.');
        console.error('Unexpected purchase error:', error.code, error.message);
    }
  });