Skip to main content

Ownership & Anti-Piracy

A common request from live-service developers: gate the in-game mod manager so it does not effectively give mod support to illegitimate copies. Important:

This gate belongs in your game client, not the AyakaMods backend

AyakaMods works the same way - its plugins do not verify ownership either; the game/launcher gates it via platform SSO.

Why the backend cannot do it​

The backend only sees an HTTP request with a valid key. It has no signal for "this running copy is legitimately owned." Ownership is a client/platform fact, not an API fact.

The correct pattern​

  1. Your client verifies entitlement locally first - Steam ownership / DRM API, Epic entitlement token, or your own launcher's license check.
  2. Only then does it initialize the mod manager and make API calls.
  3. A pirated copy fails the entitlement check and the mod UI never comes up.

Keep the key out of reach​

Keep the API key inside the signed / entitlement-gated code path, not in a plaintext config a cracked build can read. That way the key is not usefully extractable from an illegitimate copy.

The division of responsibility​

  • AyakaMods serves mods to a valid key, and (when supported) can lean on platform SSO for player identity.
  • Your client decides whether a given copy is allowed to have a valid key active.

Same split AyakaMods uses.