Workflows
Connecting Google Play
The eight steps from a service-account key to an imported catalogue, and what to check when one of them fails.
The connection flow is deliberately stepwise: each stage validates before the next begins, so a misconfiguration surfaces at the point that caused it rather than as a failed sync later.
The steps
- Introduction — what will be read, and confirmation that nothing will be written.
- Credentials — paste the service-account JSON.
- Test connection — authenticate against the Android Publisher API before anything is stored.
- Add applications — the package names to manage.
- Validate application access — confirm the service account can actually read each one.
- Import products — subscriptions, base plans, offers, one-time products, purchase options.
- Import regional pricing — current prices, availability, and store baselines.
- Completed.
Before you start
In Google Cloud, create a service account in the project linked to your Play Console and download its JSON key.
In Play Console, under Users and permissions, invite the service account's email and grant access to the apps you want to manage. Grant the monetization permission, not only View app information — see Google Play for what each level actually buys you.
Google propagates permission changes over a few minutes. Connecting immediately after granting access often needs one re-sync.
What happens to the key
The JSON key is encrypted and handed to a separate credential vault as soon as it is submitted. The application database stores an opaque random handle and a key version — never the key, and never the service-account email beyond the moment it is needed.
Authenticated calls to Google execute inside the vault worker, so the key never enters the application runtime at all. See Credential custody.
When a step fails
| Symptom | Cause |
|---|---|
| Test connection fails immediately | The JSON key is malformed, or the private key is invalid. |
| Application access validation fails for one app | The service account was not granted access to that specific app. |
| Products import but baselines do not | A permission gap on the monetization endpoint. See Store baselines. |
| A package is not found | The package name is wrong, or the developer account does not own the app. |
Error codes and their exact meanings are in Error codes.
Repairing and removing a connection
A connection whose credential is missing or unreadable can be repaired in place by re-submitting the key, without re-importing the catalogue.
A stale connection can be deleted. Deleting it removes the local mirror of everything derived from it — applications, products, plans, prices, and pricing snapshots. Nothing is written to the store: deletion only discards what Paywall Parity imported, and a re-import rebuilds it.
Re-syncing
Re-sync an application whenever you change prices in Play Console directly, grant new permissions, or want fresh store baselines.
A sync is read-only, and it is safe to run at any time. If Google refuses part of it — a conversion call fails, say — the import still completes and the failure is reported rather than discarded.