So, using the .. never trust the client.. coding methodology... 

I am used to developing for steam. The steps there is pretty simple:

1. Game client reaches out through the steam dll to generate a session ticket and sends that ticket info to the server.

2. Server reaches out to the steam servers to verify the ticket info. And bind the steam id to the player game data (characters, etc).

The above, the Server doesn't trust the data from the client, but trusts the steam servers response. Pretty simple. For itch.io. I don't see the equivalent. The closest I can find is something like the following, but I want to make sure I'm not breaking any policies, etc:

1. Client reads their API key via environment variable. And sends it to the server (encrypted). <-- I have to enforce the game to run via itch.io client -only-, never on it's own.

2. Server makes call against itch.io with that key to get the Id, and to determine if player has purchased the game. And bind the itch.io id to the player game data (characters, etc). <-- this piece is huge for me as I have no wish to store the player's api_key anywhere as I view it to be a big security issue.

I cant use OAuth since players should -never- ever have access to the game server. Does the above make sense?

Due to never, ever, trusting the client, I cannot let the client perform the api call and send the itch.io id to the server as the server has no way to verify that id and if the player has purchased the game.