# Validated pending purchases

**URL:** <https://forum.heroiclabs.com/t/validated-pending-purchases/6041>\
**Category:** Runtime Framework\
**Tags:** server-framework\
**Created:** [February 25, 2025, 2:51pm UTC](https://forum.heroiclabs.com/t/validated-pending-purchases/6041 "2025-02-25T14:51:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nixarn\_tp](https://avatars.discourse-cdn.com/v4/letter/n/4bbf92/32.png) [@nixarn\_tp](https://forum.heroiclabs.com/u/nixarn_tp)\
**Post date:** [February 25, 2025, 2:51pm UTC](https://forum.heroiclabs.com/t/validated-pending-purchases/6041/1 "2025-02-25T14:51:51Z")

</div>

Hey,

We got this one player who faked a bunch of purchases on Android. Looking at the transactions they have ‘purchaseState’ set to 1. And that’s apparently Pending. So maybe you can get a valid receipt while the purchase is pending, but we shouldn’t reward the user before it’s actually purchased.

Any clue what’s going on here and how do we prevent this, kinda feels like how Nakama handles validations that is the issue if pending purchases validate but you can’t check if they are completed or not.

Thanks

---

<div class="post-metadata">

**Author:** ![sesposito](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/sesposito/32/2594_2.png) [@sesposito](https://forum.heroiclabs.com/u/sesposito)\
**Post date:** [February 25, 2025, 3:11pm UTC](https://forum.heroiclabs.com/t/validated-pending-purchases/6041/2 "2025-02-25T15:11:01Z")

</div>

Hello @nixarn_tp,

We’re aware of this issue - Nakama is accepting a Google purchase receipt in pending status as valid, we’ll make sure to address this in the next release and reject receipts that are in “pending” state.

Best.

---

<div class="post-metadata">

**Author:** ![nixarn\_tp](https://avatars.discourse-cdn.com/v4/letter/n/4bbf92/32.png) [@nixarn\_tp](https://forum.heroiclabs.com/u/nixarn_tp)\
**Post date:** [February 26, 2025, 7:53am UTC](https://forum.heroiclabs.com/t/validated-pending-purchases/6041/3 "2025-02-26T07:53:27Z")

</div>

Got it - thanks! Looking forward to the fix, now we have to manually ban a users who use this cheat.

---

<div class="post-metadata">

**Author:** ![sesposito](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.heroiclabs.com/sesposito/32/2594_2.png) [@sesposito](https://forum.heroiclabs.com/u/sesposito)\
**Post date:** [March 6, 2025, 5:36pm UTC](https://forum.heroiclabs.com/t/validated-pending-purchases/6041/4 "2025-03-06T17:36:25Z")

</div>

FYI: [NK-639 Improve Google IAP validation. by sesposito · Pull Request #1336 · heroiclabs/nakama · GitHub](https://github.com/heroiclabs/nakama/pull/1336)