Securely detecting asset purchases and their details

[EmeraldSlash (Rio)]

Currently the only API we have available for detecting when a third party asset is purchased is with the MarketplaceService.PromptPurchaseFinished signal. Unfortunately this API is exploitable because it is based on what clients report to the server.

My team is having trouble with this because two of our games use a donation system which tracks purchases of classic clothing items and players’ gamepasses. There are two main problems:

• We need to manually check if a purchase actually got processed successfully by Roblox using MarketplaceService:PlayerOwnsAsset() and MarketplaceService:UserOwnsGamePassAsync(), but these are not ideal because they’re an extra point of failure and potential source of delays.

• The price of a purchase also cannot be verified. We can query the current price using MarketplaceService:GetProductInfo() but the result will be cached which makes it very easy to exploit and even if it wasn’t cached it’s not guaranteed to be the price that was used for the purchase. To avoid the caching we need to use the following APIs instead:

  • https://apis.roblox.com/game-passes/v1/game-passes/GAME_PASS_ID/product-info
  • https://economy.roblox.com/v2/assets/ASSET_ID/details

Related:

Pls Donate Game Donation Exploit

Sorry for reviving this thread, however, I feel like a lot of people revisit this thread looking for a solution and GetProductInfo will not work. GetProductInfo returns invalid / cached data, so relying on that at any point is unstable and can cause the bug to occur. The way I fixed this was using the following endpoints as alternatives to GetProductInfo() T-Shirts: https://economy.roblox.com/v2/assets/TSHIRTID/details Gamepasses: https://apis.roblox.com/game-passes/v1/game-passes/GAMEPASS…

[bvetterdays (roman)]

This has been brought up multiple times to staff members, and one mentioned they were working on a solution nearly a year ago now. Still no updates.

Not receiving purchase confirmation until player press "OK" in the prompt that is After the purchase

Hi there, We are investigating this internally to find the best path forward. We do think providing a mechanism where the sales location and price of an item transaction can be verified is useful and reasonable. Thank you for surfacing this!

Not receiving purchase confirmation until player press "OK" in the prompt that is After the purchase

Hi Roman, The issue is still on our teams’ radar, and it will be addressed at a later date. I will post an update once this is addressed. Thank you for your patience!

It's impossible to safely grant rewards for gamepasses bought in-game

As a Roblox developer, it is currently impossible to safely grant rewards to a player for a gamepass they have just purchased in-game. Historically, developers have used PromptGamePassPurchaseFinished to detect in-game pass purchases and grant rewards. However, it has been revealed that clients may be able to spoof this event and theoretically unlock every gamepass in the game for free, making this event unsafe to rely upon. Ideally this could be fixed with a simple safety check with UserOwnsG…