I'm trying to follow the guides on how to use a manifest to get access to a ITCHIO_API_KEY inside a HTML5 game hosted on Itch.io, but I can't seem to get access to the "Itch" global that's supposedly injected when using a manifest.

https://itch.io/docs/itch/integrating/manifest-actions.html

Here's my .itch.toml:

[[actions]]
name = "Default"
path = "index.html"
scope = "profile:me"
sandbox = true
console = true

Here's the butler validation of that toml:

>butler validate ItchAPITest
∙ Validating build directory ItchAPITest
For host 64-bit Windows (native) (use --platform and --arch to simulate others)
∙ Validating 106 B manifest at (ItchAPITest\.itch.toml)
√ Validating 1 actions...
  → Action 'Default' (index.html)
    Requests API scope (profile:me)
    Sandbox opt-in
    Console
(ItchAPITest\index.html) yielded 1 candidates when configured with dash
    | (ItchAPITest\index.html) (html)
    |-- 5.43 KiB index.html html-
    |-- ☁ Will be opened as HTML5 app
√ No prereqs listed.

My sample game is a zip file with the html and javascript and I upload it using butler.  It runs just fine in the browser, but when I try the sample code to get the ITCHIO_API_KEY from the global "Itch" it's always undefined.

Does anyone have a sample working example HTML5 app that works?

I don't know if it's broken, or my manifest is wrong, or something else.  This whole process is really opaque.

I'm pretty sure what I'm trying to do is not currently supported at this point.

Essentially the docs don't make it clear, but I believe the manifest files and actions only apply to applications run from the Itch client application, and do NOT seem to apply to hosted HTML5 games on itch.io

Furthermore you can not make calls to the server side API from inside a hosted HTML5 app on itch.io due to CORS

Even using a CORS proxy to circumvent this a call to "https://itch.io/api/1/jwt/me" will not return the currently logged in itch user.

At this point I have to assume there is no valid way to get the currently logged in itch user from a hosted HTML5 game.... which is a bummer.

Creating a OAuth flow is a lot of overhead when all you want to do is verify who's running the game.

Hi, i'm currently looking for any means to get the username of the current user (my game is made with FlutterWeb). 

Have you found a solution since your last message ?

AFAIK, the manifest only applies to games played in the itch.io desktop app.