Not sure. This design is already unusual, if you add a security layer on something not conventional, there are a few chance it works! Try to test piece by piece.

I think you can't activate IAP with an internet backend. So, you activate it at project level, and, because it's not the first entry point of the user, it might break the connection...