Launch token#

The strongest anti-piracy primitive we offer. Because we don't touch your files, a player could copy the install folder and run the executable directly. The launch token lets your game prove this specific launch, right now, is an entitled Gamearly user — and because the identity travels inside a signed token, it works even if the player has never linked their account on your servers.

Tokens are Ed25519-signed JWTs, valid for about 60 seconds, and single-use: a token can only be verified once.

Flow#

1. On launch, the Gamearly launcher requests a short-lived signed token from our servers and sets it as an environment variable on your game process.
2. Your game reads it and sends it to your backend.
3. Your backend calls POST /v1/launch_tokens/verify with your private key. We validate the signature and expiry, mark the token consumed, and return the identity plus a fresh ownership snapshot.

Your backend verifies against the fixed base URL https://api.gamearly.com/v1.

Three rules that keep it from ever breaking your game#

1. The token is never required to boot. Its absence must never crash your game.
2. Fail open. Allow single-player boot on any error — missing, expired, or Gamearly unreachable — and enforce strictly only on online services, multiplayer, or cloud saves that your server controls. A Gamearly outage or an integration bug then never blocks a paying customer.
3. Decide server-side. Your game forwards the token to your backend, which calls /launch_tokens/verify. The client never decides ownership itself. Verify once per session, because the token is single-use.

Verify from your backend#

Header X-Api-Key: <your private key>, body:

{ "token": "<the launch token from the game>" }

{
  "valid": true,
  "gamearly_user_id": "8a8c0198-6e85-4fa3-8c7f-9f6d43bcb8b2",
  "partner_user_id": "A1B2C3",
  "installation_id": "…device-uuid…",
  "issued_at": "2025-08-22T12:30:00Z",
  "entitlement": {
    "owns": true,
    "source": "STORE",
    "game_id": 42,
    "channel_id": "…",
    "build_version": "1.4.2"
  }
}

{ "valid": false, "error": "expired" }

Token lifetime#

1. About 60 seconds of validity. Read GAMEARLY_LAUNCH_TOKEN and hand it to your backend early in boot. If you read it after a long splash, a shader compile, or a title screen, verification returns expired. Compare GAMEARLY_TOKEN_EXPIRES_AT against the current time and skip the call if it has already passed, rather than spending the token on a request that cannot succeed.
2. Single use. Verify once and cache the result for the session. A second call with the same token returns already_used.
3. Environment variables are inherited by child processes. If your game relaunches itself — a graphics API switch, a bootstrapper, a mod loader — the new process inherits the same, already-spent token and will see already_used. Treat verification as once per process tree: verify in the first process and pass the result to the child yourself.