User authentication and ownership

Steamworks and the XBOX Game Development Kit (GDK) provide APIs for authenticating users and verifying that they own the title being played and/or the additional content that they’re attempting to access. There are differences in what these APIs are trying to accomplish. The Steam API verifies a user’s identity for multiplayer sessions and uses the ownership, checking to verify that the user is playing a legitimate copy of the game from the Steam store. The XBOX Game Development Kit (GDK), however, needs to sign the user in, which implicitly verifies their identity with XBOX services, and independently checks whether the current Microsoft Store account is entitled to the game. In the XBOX Game Development Kit (GDK), the two APIs used for authentication and ownership target different platforms and, in some cases, entirely different accounts. Because of this, we’ll use the term entitled to refer to a user possessing a valid license from Microsoft Store to play the current game. For more information about this and its implications, see the Differences in licensing between the two platforms section later in this topic.

User authentication

In Steam, users are always “signed in” when the client launches the game. The game can always access the user’s Steam ID without doing anything except initializing the API. Authentication in Steam refers to the process of checking whether a user’s preset identity is actually the user who’s signed in to the client that launched the game, using the ISteamUser API with session tickets (with peer-to-peer or a dedicated server), encrypted application tickets (with a secure server), or the Steam Web API. After authenticating, the Steam Web or ISteamUser APIs can use tickets to verify ownership of the current game or its downloadable content (DLC). This verification step is unnecessary in the XBOX Game Development Kit (GDK), because you’ve already done the verification when you signed the user in with the steps in Initializing the XBOX Game Development Kit (GDK). Thus, the XBOX Game Development Kit (GDK) doesn’t have an analog for the Steam session tickets or encrypted application tickets to verify a user’s identity for multiplayer sessions.

Ownership and digital rights management (DRM)

To verify that the user is entitled to the game that they’re currently playing, you need to use the XStoreQueryGameLicenseAsync function in the XStore API to check that the user has a license to play that game. In the async callback, check if:

The query succeeded (that is, the user has a license).
The license provided from XStoreQueryGameLicenseResult is still active.

If both checks succeed, you can consider that the user is entitled to play your game. In the XBOX Game Development Kit (GDK), this is the closest equivalent to using ISteamUser/CheckAppOwnership in the Steam Web API or by calling SteamEncryptedAppTicket::BIsTicketForApp with an app ticket. For more information and a code sample about performing this check, see XStore: Basic DRM and license checks. This topic also has information about more robust license checking options that exist to prevent tampering to bypass this client-side check. Steam also provides a DRM wrapper that the XBOX Game Development Kit (GDK) doesn’t have an analog to. Microsoft Store does an anti-piracy check when launching apps that are installed from it. For full DRM protection, we recommend using a third-party solution in addition to running the license check in the linked code sample.

Checking ownership for DLC

If your game has DLC associated with it, you can check whether a user’s Microsoft Store account has access to an item with the XStore API. To check these licenses, you first need to query for all the associated products with your game by using the XStoreQueryAssociatedProductsAsync function and then use the XStoreAcquireLicenseForPackageAsync function, which is similar to the ISteamUser/CheckAppOwnership or ISteamUser::UserHasLicenseForApp functions, to get the license for a specific DLC item in the list that was returned from your query. Like checking entitlement for games, you need to see if the license was successfully acquired and if it’s active. If both checks pass, you can then consider that the user is licensed to access that DLC item. For a code sample for this process, see Manage and license optional packages (DLC).

Differences in licensing between the two platforms

It’s important to note the difference in philosophy that exist between Steam and Microsoft Store. In Steam, license checks verify that the user whose identity was authenticated has a license to play the current game by having bought it or via Steam Family Sharing. The XBOX Game Development Kit (GDK), however, checks if the currently authenticated Microsoft Store account is entitled to access content and gets identity with an XBOX account. This has an important caveat—the Microsoft account used on these two accounts might not be the same, even if they belong to the same person. Therefore, it’s important to be familiar with the different licensing models that Microsoft Store offers if you’d like to restrict how many different devices can play one license of a game or other Microsoft Store content. For more information, see Product sharing model for games.

GDK and Game Engines Integration

Steam porting guide

Game Principles

Core Features

Console Features