.dev

Modules2 min read

Verified clients

Signed identity and attested-build proofs for ranked play.

assert:1 · attest:1Tier D · Shares data

Good for

  • Ranked queues that only admit real, unmodified Teho
  • Tying rewards to a proven account
  • A verified tick on your server's toasts and listing

Try it in game, no code

/tehoapi integrity Notch

The handshake only tells you a client claims to be Teho. Verified clients give you proof, signed by the Teho backend, that you can check offline.

CapabilityProves
assert:1 · identityThis connection belongs to the Minecraft account it says, on a real Teho Client, right now.
attest:1 · integrityAll of the above, and the client is an unmodified, attested Teho build.

Use identity for anything account-bound, and integrity for ranked queues and "verified only" lobbies.

Request a proof

Java
teho.verify().integrity().thenAccept(proof -> {
    if (proof.valid()) {
        rankedQueue.admit(teho.uniqueId(), proof.build());
    } else {
        player.sendMessage("Ranked needs a verified Teho build: " + proof.error());
    }
});

identity() works the same way. verifiedClient() tells you whether this player already passed an integrity check in this session. Proofs are checked against the client's real capabilities, so a client that cannot provide one gets valid() == false with an error saying so.

ProofNotes
valid()Signature, nonce, server and expiry all check out.
kind()IDENTITY or INTEGRITY.
player(), name()The account the backend signed for.
build()The client build.
issuedAt(), expiresAt()Proofs are valid for 5 minutes.
error()Why it failed, when it did.
token()The raw signed token, if you want to forward it to your own services.

How it works

  1. The SDK sends a fresh random nonce.
  2. The client asks the Teho backend to sign {uuid, server host, nonce, issued, expires, client build}. For integrity, the backend also checks the build attestation.
  3. The backend signs it with Ed25519. The client passes the token back to you.
  4. The SDK verifies it offline with the public keys from GET /v1/api/keys, and falls back to POST /v1/api/verify if it cannot.

The token is bound to your server's host and your nonce, so it cannot be replayed on another server or later.

Verified servers

The other direction: registered servers get a certificate, fetched with their server key or set in config, and sent in Welcome. Players then see a verified tick on your toasts and screens. Leave backend.url empty to use Teho's production backend, and keep your tsk_ key out of version control. teho.verifiedServer() tells you whether it was accepted.

YAML
backend:
  url: ""
  key: "tsk_…"

verified:
  certificate: ""

No code

Text
/tehoapi verify Notch
/tehoapi integrity Notch