What is a purchase token (Google Play)?

Send the token from the app to your backend, record every token you see, and check that it has not been used before. Then call purchases.subscriptionsv2.get for a subscription or purchases.products.get for a one-time product to confirm the purchase with Google. Only after those checks should you grant access, and then acknowledge the purchase within three days or Google refunds it.

For subscriptions the token stays the same through renewals, grace period, account hold and a restore. A new token appears when the customer repurchases after expiry, or when a plan change creates a new purchase, as a deferred replacement does. When a subscription has a linkedPurchaseToken, remove the old token from your database and revoke the access you granted under it, so two users are never entitled to one purchase. The token is valid from signup until 60 days after expiry.

RevenueDot keys each Google Play subscription by its purchase token. It verifies the purchase with the service account you add, acknowledges it within Google's 3-day limit, and answers 400 to the SDK when Google says the token is not valid.

Sources: Android Developers: Fight fraud and abuse · Android Developers: Subscription lifecycle · Android Developers: Integrate the Play Billing Library