- Within Partner Center, navigate to the applicable Relying Party and select the appropriate claim found in XBOX services security token claims (microsoft.com) (NDA topic). To understand which claim to use and what value is expected, look for the term “XBOX Game Streaming server” in the linked claims documentation.
- Update Claim schema to include the appropriate variable referencing XBOX Game Streaming.
- Return to the main ‘Relying Parties’ menu and click ‘Publish’.
Adjustments to an existing relying party will require a device and title restart (to clear the console cache) in order to get newly minted XSTS tokens (or wait for a period of about 4 hours for the previous one to expire).
Detect an XBOX Game Streaming server from the Device capabilities (dca) claim
After you configure your relying party to include the Device capabilities claim, your service can inspect the dca value inside the xdi (device identity) section of the decrypted XSTS token to determine whether the token was minted on an XBOX Game Streaming server.
The dca claim is an integer array. Interpret it as follows:
Because an omitted claim is indistinguishable from a misconfigured relying party, verify that your relying party publishes the
dca claim (step 1 above) before you rely on absence as a signal. For the full dca value table and other claims, see XBOX services security token claims. For a sample decoded token that shows the xdi.dca field, see Example XSTS Token, decryption, and validation.
Client-side, the game itself can call
XGameStreamingIsStreaming to detect an active streaming connection. The dca claim is the equivalent server-side signal for your title service.Device pairwise ID (dpi) on XBOX Game Streaming servers
The Device pairwise ID (dpi) claim identifies the physical hardware that minted the token. On XBOX Game Streaming servers, that hardware is a shared server in an Azure datacenter, so the same dpi value can appear for multiple different users over time.
If your service enforces per-device bans or per-device rate limits using dpi, gate that enforcement on the dca value first. When dca indicates a streaming server, exclude the token’s dpi from device-level bans and rate limits so you don’t penalize unrelated users who later stream from the same server.