Hello!

Currently I have a HTML5 testgame in prototype status and I try to get the hang of how the itch.io api is working.

For example my game has user accounts and I want to create a user account on my server side for the current itch.io user. Therefore I need a userid or something like that. I know that I can use  https://itch.io/api/1/me/me but it doesn't look really save to just 'browse' this via javascript and send the id parameter to my servers. I also found https://itch.io/t/50170/api-fo... but it looks like this information isn't working because I can't find the part 'You ask for API access by adding a line to a simple text file in your game' in the linked documentation. What line needs to be added? I also don't know which expiring key is meant.

Thanks for any advice :)

The server side API isn't designed for use with client side code. You should avoid exposing any API keys in your client code since anyone who finds it will be able to make API calls on your behalf. 

I think what you're looking for is some kind of "Log in with itch.io" feature, we don't have anything like that yet. The current server side api for fetching a user is limited right now, and most people are using the call to verifies if someone owns a game. I do want to add a OAuth login API at some point (we have one internally, it just isn't publicly available yet)

That is really too bad! My plan was to let itch.io users play our game. When they are logged in to itch.io they get a user counterpart on our servers. When they buy an item via IAP this transaction is stored on our servers and when they restart the game (it's an idle game where raiders farm maps and collect items) they get all their bought items back.

Looks like we must wait till you support some kind of login mechanism.

In the linked thread Amos mentioned following workflow:

• You ask for API access by adding a line to a simple text file in your game
• An expiring key (tied to your game and the player) gets passed as an environment variable to your game
• You can send it to your servers, and do the `/me` request from there!

This should work for our use case - Isn't this working anymore? The client sends the expiring key to our servers and our backend does the /me request and therefore knows the user who currently plays the game because the expiring key the client sends to our servers is tied to the player.

*edit*

Looks like the API key & scoping part mentioned in the docs is only working when launching the game via itch.io app. There I get the user information correctly. Game opened via browser just gets "No itch integration" (I used https://github.com/fasterthanl...) Would love to see a solution which works without itch.io app :)

Thanks anyways!