Paywall Parity/Guidelines
Run a free audit

Start here

  • Overview
  • Quickstart
  • Safety model

Concepts

  • Store baselines
  • Parity targets
  • Strategies
  • Confidence
  • Drift
  • Protected markets

Workflows

  • Connect a store
  • Review recommendations
  • Stage and publish

Reference

  • Formulas
  • Error codes

Integrations

  • Google Play
  • Apple App Store
  • Revenue signals

Trust and operations

  • Credential custody
  • Methodology

Workflows

Connecting Google Play

The eight steps from a service-account key to an imported catalogue, and what to check when one of them fails.

Shipped2 min readReviewed 2026-09-21Markdown

On this page

  • The steps
  • Before you start
  • What happens to the key
  • When a step fails
  • Repairing and removing a connection
  • Re-syncing

The connection flow is deliberately stepwise: each stage validates before the next begins, so a misconfiguration surfaces at the point that caused it rather than as a failed sync later.

The steps

  1. Introduction — what will be read, and confirmation that nothing will be written.
  2. Credentials — paste the service-account JSON.
  3. Test connection — authenticate against the Android Publisher API before anything is stored.
  4. Add applications — the package names to manage.
  5. Validate application access — confirm the service account can actually read each one.
  6. Import products — subscriptions, base plans, offers, one-time products, purchase options.
  7. Import regional pricing — current prices, availability, and store baselines.
  8. Completed.

Before you start

In Google Cloud, create a service account in the project linked to your Play Console and download its JSON key.

In Play Console, under Users and permissions, invite the service account's email and grant access to the apps you want to manage. Grant the monetization permission, not only View app information — see Google Play for what each level actually buys you.

Google propagates permission changes over a few minutes. Connecting immediately after granting access often needs one re-sync.

What happens to the key

The JSON key is encrypted and handed to a separate credential vault as soon as it is submitted. The application database stores an opaque random handle and a key version — never the key, and never the service-account email beyond the moment it is needed.

Authenticated calls to Google execute inside the vault worker, so the key never enters the application runtime at all. See Credential custody.

When a step fails

SymptomCause
Test connection fails immediatelyThe JSON key is malformed, or the private key is invalid.
Application access validation fails for one appThe service account was not granted access to that specific app.
Products import but baselines do notA permission gap on the monetization endpoint. See Store baselines.
A package is not foundThe package name is wrong, or the developer account does not own the app.

Error codes and their exact meanings are in Error codes.

Repairing and removing a connection

A connection whose credential is missing or unreadable can be repaired in place by re-submitting the key, without re-importing the catalogue.

A stale connection can be deleted. Deleting it removes the local mirror of everything derived from it — applications, products, plans, prices, and pricing snapshots. Nothing is written to the store: deletion only discards what Paywall Parity imported, and a re-import rebuilds it.

Re-syncing

Re-sync an application whenever you change prices in Play Console directly, grant new permissions, or want fresh store baselines.

A sync is read-only, and it is safe to run at any time. If Google refuses part of it — a conversion call fails, say — the import still completes and the failure is reported rather than discarded.

PreviousProtected marketsNextReviewing recommendations

On this page

  • The steps
  • Before you start
  • What happens to the key
  • When a step fails
  • Repairing and removing a connection
  • Re-syncing