Is purchaseToken of Android IAB globally unique?

Question

I know that we can't use orderId as globally unique transaction ID in testing because orderId can be null.

In https://developer.android.com/google/play/billing/billing_testing.html

Note: Test purchases don't have an orderId field. To track test purchases, you use the purchaseToken field instead.

It is not clear to me whether or not purchaseToken is globally unique.

In https://developer.android.com/google/play/billing/billing_reference.html

A token that uniquely identifies a purchase for a given item and user pair.

It can be duplicate when it is a purchase for another item or user?

How can I identify all testing purchases?

Arbutus

Answer 1

Yes, it is globally unique.

https://developer.android.com/google/play/billing/security

purchaseToken is globally unique, so you can safely use this value as a primary key in your database.

Exploit