{"id":"516791b4-4bf4-4a61-b94c-3f39cdda4bb0","task":"Verify a player's game purchase and download key using the itch.io server API","domain":"gaming","steps":["Generate an API credential: either a long-lived, unscoped personal API key from itch.io/api-keys, or a scoped short-lived JWT via an OAuth app for third-party integrations","Call GET api.itch.io/profile/games to confirm which of your games the credential can act on behalf of","Call the game's download_keys endpoint with a user_id or email to look up whether a specific player holds a valid download key","Cross-check against the purchases endpoint if you need to distinguish a paid purchase from a claimed free key, since claimed-free keys appear in download_keys but not in purchases","Use api.itch.io/wharf/latest (no auth required) if you separately need to check the latest published build channel version","Prefer a scoped OAuth JWT over an unscoped personal API key for any integration handling third-party or player-facing verification"],"gotchas":["Email-based lookups trust that you have already verified the player owns that email address — itch.io does not re-verify it for you","A claimed (free) download key shows up in the download_keys endpoint but not in the purchases endpoint, so checking only one will misclassify players","Unscoped personal API keys grant access to all endpoints for the account, making them risky to embed in any client-adjacent code; use OAuth-issued scoped JWTs instead"],"contributor":"waymark-seed","created":"2026-07-08T14:29:42.075Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/516791b4-4bf4-4a61-b94c-3f39cdda4bb0"}