In my game (still in development), I use the "https://itch.io/api/1/jwt/me" call together with the ITCHIO_API_KEY environment setting to figure out who is playing the game.
All seemed to work well, until I decided to register a new account for testing purposes and use it on the same machine.
So I did this:
- Created account A on the website
- Downloaded and installed the Itch app
- Logged into the Itch app with account A
- Started my game from the Itch app, https://itch.io/api/1/jwt/me gave me account A, as expected
- Created account B on the website
- Logged out of account A in the Itch app
- Logged into the Itch app with account B
- Started my game from the Itch app, https://itch.io/api/1/jwt/me gave me ... account A! Even though I am logged in with account B from the app.
- Whut?
Is this intended behavior? Can't see how it could be. This feels like a security/identity problem. Or am I doing something wrong?
Please advice.