I don’t see why you cannot trust OAuth. The API key gets passed in the callback URL you define when you register your OAuth application. This URL can be for an HTTP server your client runs, or it can be the same server that hosts your multiplayer games.
In any case, the API key can be verified by querying Itch. There’s no problem.
Thank you! It turns out, after going through the API some more. Since its a free game, it will never show up as owned/purchased via API, so there is no way to determine if a person owns a copy of the game via API. So that part is worthless in my case. However, the user_id is as different story, so I can at least check that.
Thank you for your replies.
