The documentation link: https://developer.squareup.com/docs/pos-api/build-mobile-web#step-5-test-your-code suggest straight forward code like this:
<a href="intent:#Intent;
action=com.squareup.pos.action.CHARGE;
package=com.squareup;
S.browser_fallback_url=https://my.website.com/index.html;
S.com.squareup.pos.WEB_CALLBACK_URI=https://my.website.com/index.html;
S.com.squareup.pos.CLIENT_ID=sq0ids-yourClientId;
S.com.squareup.pos.API_VERSION=v2.0;
i.com.squareup.pos.TOTAL_AMOUNT=100;
S.com.squareup.pos.CURRENCY_CODE=USD;
S.com.squareup.pos.TENDER_TYPES=com.squareup.pos.TENDER_CARD,com.squareup.pos.TENDER_CASH;
end">Start Transaction</a>
I tested it and it does not open any link, my devide already have app installed.
When I try this code:
Take a QR code 2
It open play store app with squareup pos app information, I need to directly open the app and not play store screen of the app, is there any way?
*UPDATE:
I got transactions to work after adding S.com.squareup.pos.LOCATION_ID={{ my_location_id }}. The location ID can be found in Square Developer Portal > Locations. Also if the POS app is passcode protected, you have to open and login with passcode before sending transaction.
*END UPDATE
I've been working through this same issue. I still haven't gotten a transaction to work, but have at least gotten the app to open.
Make sure the CLIENT ID is your production application ID. NOT sandbox.
The WEB_CALLBACK_URI needs to match the Web Callback URL defined in your Square Developer Portal > Point Of Sale API.
I hope this helps. If you do figure this out and get transactions to work, please post your solution for me and others who are sure to run into this issue since the documentation is lacking.
If I install the app when clicking the dynamic link. All of that information from dynamic should be still available when I open the app for the first time.How can I get that information? It is not working when I use this: getInitialLink() returns Promise<string|null>;
Since, you haven't mentioned - I'm assuming you are having problems with shorter urls, if that's the case try putting the longer url.
Or refer here on Simon's answer: When I use the long instead of short links, everything works perfectly fine.
On Android, you use the getInvitation() method to get data from the Dynamic Link:
AppInvite.AppInviteApi.getInvitation(mGoogleApiClient, this, false).setResultCallback
(/* ... */);
Then, in the callback, you can get the data passed in the Dynamic Links link parameter by calling the getDeepLink() method:
Firebase Documentation - Use Case
For future reference or detailed answer on Firebase Dynamic Links
Behave just like normal Links
In cases where the application doesn’t require installation (say, if it’s already installed) then clicking the Dynamic Link will automatically open the link to the desired screen.
Dynamic Links have a very simple process flow:
The user begins by clicking the Dynamic Link
If the the needs of the Dynamic Link target are satisfied (this is, the application being installed) then the user is navigated to the target location
Otherwise, if the application requires install in order to navigate
to the Dynamic Link target, the the user is taken to the point of
install for the application. Once the application has been installed,
the user is navigated to the target location of the Dynamic Link
And if that wasn’t all, we can integrate Dynamic Links with Firebase Analytics to track the interaction with any links that we generate for our applications. But if we only require simple tracking, then we can use the automatic built-in analytics from the Dynamic Links panel within the Firebase Console where we can also obtain attribution and referrer information for interacted links with no extra effort required from our side.
What makes it different from Google Analytics?
One of the first things that came to my mind when I read about Firebase Analytics was, “What about my Google Analytics setup?”. So if you already have Google Analytics in place, then why would you make the switch to Firebase Analytics? Well, here’s a couple of differences between the two:
Audiences
We can use Firebase Analytics to create Audiences — these are groups of users that we can then interact with using other Firebase service such as Firebase Notifications and / or Firebase Remote Config.
Integration with other Firebase Services
An awesome thing with Firebase Analytics is that we can integrate other Firebase services with analytics. For example, creating an Audience of users who have experienced a crash reported through Firebase Crash Reporting.
Lower Method Count
The Google Analytics dependency on Android has a total count of 18,607 methods and has a total of 4kb used for dependancies. On the other hand, Firebase Core (for Analytics) has a method count of 15,130 and only 1kb used for dependancies.
Automatic Tracking
When we add the firebase core dependency, it will automatically begin tracking a collection of user engagement events and device information for us — this is useful if you’re looking to only collect the minimal data for your app.
Unlimited Reporting
For up to 500 events, Firebase Analytics provides us with unlimited reporting straight out of the box for free!
No Singleton Initialisation
When setting up Google Analytics on Android we are required to initialize a Singleton instance. Firebase Analytics are simply available by fetching the instance directly from where we wish to track data. This isn’t much effort obviously but just makes the setup flow slightly easier.
Single Console
All of the data for every Firebase service is available for a single console. That makes it both easier and quicker for us to navigate from checking the analytic stats for our app to viewing the latest crash reports.
It looks like this is a react-native-firebase open bug for android
For fix the only thing that is required to be changed in module code:
private boolean isInvitation(PendingDynamicLinkData pendingDynamicLinkData) {
return FirebaseAppInvite.getInvitation(pendingDynamicLinkData) != null;
}
to
private boolean isInvitation(PendingDynamicLinkData pendingDynamicLinkData) {
FirebaseAppInvite invite = FirebaseAppInvite.getInvitation(pendingDynamicLinkData);
if (invite != null && invite.getInvitationId() != null && !invite.getInvitationId().isEmpty()) {
return true;
}
return false;
}
Bug reference : https://github.com/invertase/react-native-firebase/issues/1273
Please Check Your Manifest file
open AndroidManifest.file => In your activity tag there is intent-filter tag put below line in that tag.
<data android:scheme="https" android:host="your.dynamic.link" />
<data android:scheme="http" android:host="your.dynamic.link" />
If already done then check this link for the full blog on the dynamic link with react native.
Link: http://blog.logicwind.com/react-native-dynamic-links-using-firebase/
I hope this will help. sorry for the typos.
I recently came across this app Purchase Apps, which is somehow able to retrieve apps I've paid for in google play after I signed in using my google account.
I'm trying to find out how it is being done as I want to build a similar app, but for the free apps which were downloaded.
However, I can't find which OAuth API Scope was used for retrieving that information, even after going through the entire list of APIs.
EDIT:
I'm putting a new bounty on this question, as suggested by a similar question I've asked about here, and because here and there I don't see a real answer about how to do it, and what can be done with it.
I'd like to refine the questions into multiple pieces:
What is the API that can be used to get information of purchased apps? Where can I read about it? Please show a full, working example of how to do it.
Can it do more ? Maybe perform search? Maybe show free apps that were installed? Maybe the time they were installed and uninstalled? And the categories of those apps?
Are there any special requirements for using this API ?
EDIT: I'm putting a max bounty on this, because no matter how much I've read and tried, I still failed to make a POC that can query the apps from the Play Store that the user has ever downloaded (name, package name, date installed and/or removed, icon URL, price...), including both paid and free apps.
If anyone finds a working sample, show how it's done, and also show how you've found about it (documentation or anything that has led you to the solution). I can't find it anywhere, and the current solutions here are too vague for me to start from.
Issue is resolved. The exploit has been closed.
We will be closing this bug due to being logged in a Preview version of Android. If the issue is still relevant and reproducible in the latest public release (Android Q), please capture a bugreport and log the bug in https://source.android.com/setup/contribute/report-bugs. If a reply is not received within the next 14 days, this issue will be closed. Thank you for your understanding.
Latest update:
This is a bug and Google will address it in the next update.
We've deferred this issue for consideration in a future release. Thank
you for your time to make Android better
This answer has turned into a conglomeration of ideas and been edited to include information from discussion in the comments.
The androidmarket api, would be a customised api written by the developer. It's not available to the public.
To address your concerns in the comments. The developer would have utilised the current apis available through Android Developer and Google to create a project that manages all of these.
As for accessing Full Account Access, I'm not sure exactly how these developers have achieved this.
I'd recommend using the AccountManager, which is part of android.accounts, has access to credentials and a method getUserData. The account manager has access to passwords and is capable of creating and deleting accounts. This, possibly used with Content Provider
See Udinic/SyncAdapter Authentication.
To reply to your comment:
This blog should help you to get started. Write your own Android Authenticator.
How these apps actually work, I cannot tell you. They may also have different implementations (unless they're a collaborative effort behind the scenes, they most certainly will be different).
One guess. Firstly use GoogleSignInAccount with com.google.android.gms.auth.api.signin.
There a definition for scope, to determine the extent of the permissions the app is granted.
Using requestScopes(), the
public static final String PROFILE
.../ It lets your web app access over-the-air Android app installs.
For example:
GoogleSignInOptions gso =
new GoogleSignInOptions.Builder(GoogleSignInOptions.DEFAULT_SIGN_IN)
.requestEmail().
.requestScopes(new Scope("https://www.googleapis.com/auth/contacts.readonly"))
.build();
If full access can be gained a list of all apps used by the account holder can be found and compared to what's on the device.
Package Manager will retrieve a list of all apps currently installed on the device.
PackageInfo provides the details about the app.
INSTALL_REASON_USER will also filter out apps that have been actively installed by the user.
You might want to look at com.google.firebase.appindexing and Log User Actions. Different actions can be tracked.
The users account history is found at https://myactivity.google.com/myactivity.
A helpful link is the OAuth 2.0 Playground.
This github repo node-google-play, using node, is current and will call Google Play APIs. As did the archive that was used as an "unofficial" api, android-market-api, to query the market place.
App 1
The app claims to use the following permissions:
Version 2.1.8 can access:
$ In-app purchases
Other
receive data from Internet
view network connections
full network access
use accounts on the device
prevent device from sleeping
read Google service configuration
Noteworthy, the app doesn't set any permissions when there was a basic, install. I was unable to use any of the features, as I have no paid apps. So for the initial search - there were no permissions needed, which would indicate the app didn't have access to my account.
I checked the permissions - there were none set. So the only thing required was to accept the pop up, as displayed in your question.
App 2
The other app you refer to that does the same thing is more upfront about what is being accessed.
My Paid Apps
SECURITY/PRIVACY NOTICE
The first time you run this app, it will ask for full permission to your Google account. This is unfortunately
the only way to access the required information. No personal
information is stored, no information about your apps is shared with
the developer of this app, nor shared with any third parties.
Everything is kept on your phone only.
I've gone into detail over these apps in this blog post, which was for a university capstone project (no monetary gain). I'm inclined to think this is an exploit in the API and not status by design by Google, as there are no API calls to fetch purchases of apps other than the developer's own app. I hypothesize it's a zero day exploit, in which case there's no legitimate way to access this information.
In case of one of these applications (My Paid Apps), after checking the network traffic it is pretty obvious that it does use the Store's Account page to retrieve the list of paid applications.
Now, the mechanism it uses is the same mechanism that Google Chrome currently, and Pokemon GO supposedly at a point in time used.
In a nutshell, steps to do so are as follow:
Login:
What the mentioned program do for the first step is to log the user in and get access to the user's access token. To do so, it uses the android.accounts.AccountManager.getAuthToken() method. (See more: AccountManager)
However, as for the token scope, oauth2:https://www.google.com/accounts/OAuthLogin is requested.
It might be important to note that based on the OAth2 documentation from Google, this scope is not valid; however, it seems like a valid scope for Google OAuth v1.
Converting the newly retrieved access token to a ubertoken:
Now, what actually ubertoken supposed to do, is unknown and there is no official documentation about it. However, it was seen in the wild to be used by chrome browser to login users.
This is done by requesting the https://accounts.google.com/OAuthLogin?source=ChromiumBrowser&issueuberauth=1 page.
Converting ubertoken to website session:
Later on, using the newly created ubertoken it is possible to get a website session using the https://accounts.google.com/MergeSession API endpoint. After this step, the application is essentially capable of loading all personal pages that you can open using your browser while logged in; except some special pages including Payment settings.
Retrieving the list of paid applications:
Requesting and parsing the https://play.google.com/store/account page.
Following is the application's traffic as captured by 'Packet Capture':
As it is clearly visible in the picture, the end result is identical to what I get when I normally open the store's account page on my PC with Chrome Desktop:
Side note:
It seems none of these endpoints are documented as they are primarily used by Google's own programs and should be considered internal. Therefore I strongly recommend not using them in any program or code that you expect to run for a long time or in a production environment.
Also, there is bad news here for you too, it seems that the Google Play's account page only lists paid applications or special free apps (more especially OEM apps). I will try to find some time and dig deeper into the other application.
Interesting articles:
Pokemon tokens
Exploiting Google Chrome's OAuth2 Tokens
If you have root access, You can access /data/data/com.android.vending/databases/library.db
OnePlus3T:/data/data/com.android.vending/databases
-rw-rw---- 1 u0_a2 u0_a2 229376 2018-12-26 18:01 library.db
This database has all information, which app you have downloaded, which apps you have purchased, and even in which app you have done IAP.
Check ownership table, It has all information.
ownership (account STRING, library_id STRING, backend INTEGER, doc_id STRING, doc_type INTEGER, offer_type INTEGER, document_hash INTEGER, subs_valid_until_time INTEGER, app_certificate_hash STRING, app_refund_pre_delivery_endtime_ms INTEGER, app_refund_post_delivery_window_ms INTEGER, subs_auto_renewing INTEGER, subs_initiation_time INTEGER, subs_trial_until_time INTEGER, inapp_purchase_data STRING, inapp_signature STRING, preordered INTEGER, owned_via_license INTEGER, shared_by_me INTEGER, sharer_gaia_id TEXT, shareability INTEGER, purchase_time INTEGER, PRIMARY KEY (account, library_id, backend, doc_id, doc_type, offer_type))
Dealing with unofficial Google APIs is incredibly complicated territory. It's going to be possible to get this to work, but that's all I'll say. Proceed at your own risk.
The first thing you're going to need to do is get a Google Play auth token. This can be done several ways, but here's how they do it in Purchased Apps:
public static String getAuthToken(Activity activity, String userEmail) {
AccountManager accountManager = AccountManager.get(activity);
Account userAccount = new Account(userEmail, "com.google");
Bundle options = new Bundle();
options.putBoolean("suppressProgressScreen", true);
String token;
try {
Bundle result = accountManager
.getAuthToken(userAccount, "androidmarket", options, activity, null, null)
.getResult();
token = result.getString("authtoken");
} catch (OperationCanceledException e) {
Log.d(TAG, "Login canceled by user");
return null;
} catch (IOException | AuthenticatorException e) {
Log.e(TAG, "Login failed", e);
return null;
}
return token;
}
A few things to note here:
The above code must be run asynchronously. I recommend RxJava, but an AsyncTask will work.
You must supply a email for the account you want to use. I'll leave the details up to you but this is fairly easy using AccountManager.
After you have an auth token, you can now access any Google Play Store endpoint. The main one used by Purchased Apps is https://android.clients.google.com/fdfe/purchaseHistory. Another one you might be interested in is https://android.clients.google.com/fdfe/details?doc=(package name) (from APKfetch code). Here's a page with some more and some analysis. If you make a request to these APIs, you'll need to supply several headers:
Authorization - "GoogleLogin auth=(your auth token)"
User-Agent - "Android-Finsky/6.4.12.C-all%20%5B0%5D%202744941 (api=3,versionCode=80641200,sdk=" + VERSION.SDK_INT + ",isWideScreen=0)";
X-DFE-Device-Id - your device's Google Services Framework ID, obtained from AdvertisingIdClient.
X-DFE-Client-Id - "am-android-google"
Accept-Language - The device's language code, eg "en".
Now, you need to parse the response. Here's where things get tricky. These APIs returns a message encoded as a Protobuf, so it's essentially just binary data unless you have a schema (which of course, only Google has). One way to go about this in theory is to decompile the Google Play Store app and reuse their generated protobuf models with a tool like JADX.
Unfortunately, I've tried this and it doesn't really work. Protobuf model classes are just too complex for a standard decompiler. What you can use is a tool called PBTK. You'll ideally want to run this on the Google Play Store 6.1.12 APK, since that's the last version before they started using ProGuard. Do note that this program has two errors in its script that need to be fixed before running it: changing 'extracto' to 'extractor' in gui.py and removing the assertion statement on line 500 of jar_extract.py.
Now, that should output all of the response classes as .proto files. Create a folder under src/main called proto and drag the entire generated 'com' directory to it. You can delete everything that's not under com/google/android/finsky/protos. Follow instructions online to setup Gradle with the Protobuf Lite plugin.
When you want to parse a response, you can use the ResponseWrapper class, since they all appear to be contained under that.
That's about as far as I can take you. There's a good chance I got some part of this wrong; JADX is your best friend here, because the best way to figure out what an app is doing is by looking at its code. Hope this helps and happy developing!
you can get the package name of all installed apps on device and then get the information of every installed package that you find in the device from google play without any need to get to user account. there is some third party or unofficial apis to get google play apps details as json by getting the app package name. for example: https://42matters.com/
then use the received information for every package to find free ones.
i have two resources for you to consider, but first, in a word, no. there is no api from GOOGLE to let you do what you want, as these metrics arent stored in the phone, they are on the google play store servors, and google has no OFFICIAL api for the play store. you can however glean some info from these two sites:
https://www.quora.com/Is-there-an-API-for-the-Google-Play-Storeenter link description here
https://android.stackexchange.com/questions/162146/how-to-see-all-the-apps-i-have-downloaded-from-google-play-store
and this is enough to see how to accomplish this.
first, a list of what apps have been downloaded by an account is only referencable by the account. and this can be done through the play store. since your app will be installed on that users phone, this dosnt matter... you're in.
second, you will need a 3rd party API built for the GOOGLE PLAY STORE, there are some out there, check the first link.
using the api of your choice, you will send a get request, to the play store, and in return you should receive in most cases a json object to deserialize.
deserialize the object, and you will have your list. which list you get will depend on the endpoint you use, but that should be explained by/in the API itself.
good luck!
We are developing an app that should get data from the Moves app API.
When authorising our app on the mobile phone, we manage to do so successfully in the case in which we submit the PIN provided by the desktop link into the moves app:
https://api.moves-app.com/oauth/v1/authorize?response_type=code&client_id=<client_id>&scope=<scope>&state=<state>
In the case where I use the Mobile website / app link instead, this won't work:
moves://app/authorize?client_id=<client_id>&scope=activity%20location&state=<state>&redirect_uri=<redirect_uri>
Note: <redirect_uri>==encodeURIComponent("mymovesconnector:8081/callback").
The response we get from the Moves API is 400: {"error":"invalid_grant"}.
From the docs, it says that invalid_grant can happen if either:
the code in the request is not valid or
the code has expired (it’s valid for 5 minutes currently) or
the code has been revoked, because it was already used in an access token request (both successful and unsuccessful requests will revoke the code) or
you are missing the redirect_uri parameter when it’s required.
My checklist:
I guess this could have happened, but how/why should this code, provided over moves://, be different than the one provided through the https:// request? What control do I have over this?
not my case, since I'm using the code right away within less then a few seconds
if this might have happened, where could it happen other than through the redirect url?
I'm providing it always. It's always the same - also in the app settings on moves.
Can't figure out what I'm missing. Went through the docs many times, step by step. No success.
While writing down my question, I managed to figure out a solution to this problem.
The docs don't point out that response_type=code might also be used for the moves:// link. I tried to add this parameter, and it worked!
Note: this has been tested on a virtual android device only (Genymotion).
I am looking for an alternative for captcha to use in our mobile applications. We are writing a mobile application in iOS and Android. The web application is already exist. In the web page we are using captcha to ensure only genuine customers are applying and to prevent denial of service type attacks.
So from mobile app also we need to take care of these. Any body came across the same situation? Is it recommended to use captcha in native mobile apps?
A mechanism to prevent automated traffic must definitely be used. Not doing so means you will allow a way to access your servers which can be automated. Even though you might think it is only available from mobile apps, an attacker code can run anywhere and bring your system to halt.
If your concern is that captchas will be inconvenient to mobile users, try google Recaptcha. Where usually its a click of checkbox or clicking some images in some cases where google is not able to determine based on the checkbox.
https://www.google.com/recaptcha/intro/index.html
There is a library for android using google recaptcha
https://github.com/ayltai/Android-Lib-reCAPTCHA
Android-Lib-reCAPTCHA
The reCAPTCHA Android Library provides a simple way to show a CAPTCHA as an ImageView in your Android app, helping you stop bots from abusing it. The library wraps the reCAPTCHA API.
Quick Start
First you have to sign up for your API keys.
Installation
repositories {
jcenter()
}
dependencies {
compile 'android.lib.recaptcha:reCAPTCHA:+'
}
The Layout
To show CAPTCHA image, you need to add a <android.lib.recaptcha.ReCaptcha /> element to your layout XML:
android.lib.recaptcha.ReCaptcha
android:id="#+id/recaptcha"
android:layout_width="match_parent"
android:layout_height="wrap_content"
android:scaleType="centerInside" />
It is important to use android:scaleType="centerInside" to ensure the entire CAPTCHA image can be displayed.
Alternatively, you can create an instance of android.lib.recaptcha.ReCaptcha at runtime:
ReCaptcha reCaptcha = new ReCaptcha(context);
How to show CAPTCHA
In your activity/fragment/view containing android.lib.recaptcha.ReCaptcha, you need display a CAPTCHA image for the user to response:
ReCaptcha reCaptcha = (ReCaptcha)findViewById(R.id.recaptcha);
reCaptcha.showChallengeAsync("your-public-key", onShowChallengeListener);
showChallengeAsync downloads and shows CAPTCHA image asynchronously. It is safe to invoke in UI thread. No exception will be thrown in case of any error by this call. All errors will be treated as unsuccessful in showing CAPTCHA image.
onShowChallengeListener is an instance of ReCaptcha.OnShowChallengeListener, which is called when an attempt to show a CAPTCHA is completed.
The synchronous version of this method is showChallenge.
How to verify user input
To verify user input, pass the input string to ReCaptcha.verifyAnswerAsync (or ReCaptcha.verifyAnswer):
reCaptcha.verifyAnswerAsync("your-private-key", "user-input", onVerifyAnswerListener);
verifyAnswerAsync asynchronously submits the user input string to reCAPTCHA server for verification. It is safe to invoke in UI thread. No exception will be thrown in case of any error by this call. All errors will be treated as verification failure.
onVerifyAnswerListener is an instance of ReCaptcha.OnVerifyAnswerListener, which is called when an attempt to verify the user input is completed.
The synchronous version of this method is verifyAnwser.
Specify a locale
You can force the widget to render in a specific language. Please refer to this page.
reCaptcha.setLanguageCode("fr");
Sample Application
A complete sample application is available at https://github.com/ayltai/Android-Lib-reCAPTCHA/tree/master/reCAPTCHA-Samples.