First of all, let me start off by saying that your whole approach of this is super prone to hackers. You should never trust the client. What you should do is when the button is clicked, fire a remote event to the server to handle all of that.
--server
local function promptPurchase(player)
marketPlaceService:PromptProductPurchase(player, productId)
end
local function onPromptFinished(player, assetId, purchased)
if purchased then
--give the currency
end
end
--client
local function onClick()
remoteEvent:FireServer() --the event that tells the server to prompt the player
end