How to implement security with App+database

[Muhannd Dhahier]

In play store, I found an App I want to do the same security that the developer did there.
The App consists of 4 tabs the first and second is available to everyone after installing the App, but tab3 and tab4 is not available, when we click on tab3 there is a text for a just password, we need to contact the developer to pay fee and give him the password and the brand of the phone , then the tab3 and 4 will be activated.
The app brings information from a database for tab1 and tab3 and tab4
is anyone has an idea how to implement that like, can we use FirbaseStorage, or we need to use Mysql or other databases.

Note: If password used with different devices, it will not working.

[Tim Moores]

Sounds like a standard use case for in-app billing.

can we use FirbaseStorage, or we need to use Mysql or other databases.

I don't see how the choice of a DB plays into this.

If password used with different devices, it will not working.

You might want to rethink that. The standard expectation on Android is that all apps work on all devices where a user is signed in with the same Google account. You would have to have a very good reason to break this expectation in order not to antagonize users.

[Muhannd Dhahier]

But I think with the Firebase DB I can't just use a password .I need username and password.

also, I noticed in this App the password will be working only on one device.I think the developer get IMEI number from the device that installs the App to prevent use the password with the different device, Is this against Google policy to get the IMEI and save it to chek later?

[Tim Moores]

But I think with the Firebase DB I can't just use a password .I need username and password.

I think the easiest way to authenticate a user would be by tapping into their Google account: https://developers.google.com/identity/sign-in/android/sign-in. If you want to roll your own (which I wouldn't recommend), you could write a REST web service that handles authentication. That way it wouldn't matter what kind of DB is used.

also, I noticed in this App the password will be working only on one device.I think the developer get IMEI number from the device that installs the App to prevent use the password with the different device, Is this against Google policy to get the IMEI and save it to chek later?

Why do you want the password to work on a single device only, rather than for a single user? These days everyone has multiple devices, and being able to use just a single one would be an inconvenience that users will neither expect nor like.

[Muhannd Dhahier]

Because of  when he buy the App, he will not able to share the password with the others

[Tim Moores]

In that case, tapping into the Google account is even better, since people definitely will not share those credentials.

But either way, you're better off making user's life easier instead of antagonizing them.

[Muhannd Dhahier]

I agree with you but most of the users don't have Gmail account, they want just used a password to login and chek the information, I wish that I can use the Google account or whatever email for credentials, but these are the requirement for this App.