Entitlement Check for Meta Horizon Store Apps
Apps being sold in the Meta Horizon Store that wish to pass
VRC.Quest.Security.1, or wish to implement anti-piracy measures, can perform a platform-level check to verify the user purchased or obtained your app legitimately. This check is called the entitlement check. You should make the entitlement check within 10 seconds of the user launching your app.
The entitlement check does not require the user to be connected to the Internet. Also, you must handle a failed entitlement check in your app code. A failed entitlement check won’t result in any action on its own. For example, if the check fails, you could show the user an error message and quit the app, or go into a limited demo mode.
Initialize the Platform and Perform the Entitlement Check
Before you perform the entitlement check, you must initialize the platform.
There are two initialization functions you can call with your App ID. One is synchronous and runs on the thread you initialize on, the other is asynchronous and allows you to perform other functions, including calls to the Platform SDK, while the SDK is initializing. We recommend using the asynchronous method for better app performance and less state management, especially for Android apps.
| Platform | Synchronous Method | Asynchronous Method |
|---|
Native Link PC-VR | ovr_PlatformInitializeWindows()
| ovr_PlatformInitializeWindowsAsynchronous()
|
The following example code shows:
- A synchronous initialization call for a Link PC-VR app.
- A second call to
ovr_Entitlement_GetIsViewerEntitled(). This call checks the user entitlement and verifies that the user owns your app.
Both steps are required to successfully initialize the SDK. The entitlement check should be made within 10 seconds of the user launching the app.
// Initialization call
#define OCULUS_APP_ID "some-app-id"
// Initialization call
if (ovr_PlatformInitializeWindows(OCULUS_APP_ID) != ovrPlatformInitialize_Success)
{
// Exit. Initialization failed which means either the oculus service
// isn’t on the computer or the DLL is not valid.
}
When the SDK has finished initializing, a ovrMessage_PlatformInitializeWindows message will be sent to the queue.
| Platform | Synchronous Method | Asynchronous Method |
|---|
Native Android | ovr_PlatformInitializeAndroid()
| ovr_PlatformInitializeAndroidAsynchronous()
|
The example below shows the asynchronous initialization call for an Android game. When using the asynchronous call, the SDK is placed in an intermediate initializing state before full initialization. In this initializing state you’re able to run other processes, including making calls to asynchronous Platform SDK methods. Requests made to the Platform SDK in the initializing state will be queued and run after the SDK finishes initializing.
The second call in the example below is the entitlement check that verifies that the user owns your app.
// Initialization call
#define OCULUS_APP_ID "some-app-id"
if (ovr_PlatformInitializeAndroidAsynchronous(OCULUS_APP_ID) != ovrPlatformInitialize_Success)
{
// Exit. Initialization failed which means either the oculus service isn’t
// on the machine or they’ve hacked their DLL
}
ovr_Entitlement_GetIsViewerEntitled();
When the SDK has finished initializing, a ovrMessage_PlatformInitializeAndroidAsynchronous message will be sent to the queue.
After initializing the SDK with either initialization method and making the entitlement check, you’ll need to check the response of the entitlement check and handle the result. The following example immediately quits the application if the user is not entitled to your app. You may wish to handle the situation more gracefully by showing the user a message stating that you were unable to verify their credentials, suggest that they check their Internet connection, then quit the app.
// Poll for a response
while ((message = ovr_PopMessage()) != nullptr)
{
switch (ovr_Message_GetType(message))
{
case ovrMessage_Entitlement_GetIsViewerEntitled:
if (!ovr_Message_IsError(message))
{
// User is entitled. Continue with normal game behavior
}
else
{
// User is NOT entitled. Exit
}
break;
default:
break;
}
}
You can perform additional user verification if you want to verify the identity of the user to your back-end server.
User Verification provides a cryptographic nonce you can pass to verify that the user’s identity. This method does not replace the entitlement check. For more information on how to verify the user, see
User Verification.
Enable Developer Mode
This only needs to be done once per device.
Note: To set up an Link PC-VR device for development, see the
PC SDK documentation.
You may need to restart your headset after doing these steps. Once done, there will be a new option in your headset library called “Unknown Sources”.
Test Entitlement Check
Replace Platform App ID with a random string of numbers.
Attempt entitlement check in editor, or build as APK and test in headset.
The entitlement check should fail.
How can I do in-editor tests of app features that require the user to pass entitlement checks?
You can use
Meta XR Simulator to test and debug apps. To setup a test user in the Unity project, go to Oculus Platform Settings and set “Use Standalone Platform” to true and provide the credentials of a test user with entitlements to the app. After that, running the game in Meta XR Simulator, the entitlement checks and other platform calls should work fine.
What are the possible reasons that cause some users to fail the entitlement check?
- Only test users from the tested app’s organization pass entitlement checks: Test users associated with a different organization than the app’s organization may not have the necessary entitlements to access the app, leading to failed checks.
- Pushing a New Version of the App: When a new version of an app is pushed, it may affect the entitlements. It is crucial to ensure that all users are in the correct channels and that the new version has a higher version number, to cause users to re-trigger the update process correctly for entitlement verification.
- Need to Push APK to a Channel to Create Initial Package Name -> App ID Mapping: For a new app, the initial mapping between the package name and the app ID is established when the APK is first pushed to a channel. If this step is not completed, the entitlement checks will fail because the system lacks the necessary mapping to verify the entitlements. For guidance on locating the package name, please refer to the subsequent question.
- App ID/Package Name Mismatch: Once an app ID has been associated with a package name through the above steps, if there is a mismatch between the reported app ID and package name of the app making an entitlement check, and the system-recorded package name for that app ID, the system cannot correctly identify and authenticate the entitlements associated with the app. Please make sure the app ID used to check entitlement matches the package name in the app manifest. For guidance on locating the package name, please refer to the subsequent question.
- Need for Assigning Users/Test Users to the correct Channels: To access specific apps, users or test users need to be assigned to the correct channels. This ensures that they are entitled to use the app and can access its features and content.
How to find Package Name of an App in the Meta Quest Developer Dashboard?
Select your application.
In the left-side navigation, select Distribution > Builds.
On the Builds page, in the Build column, click the hyperlink of the build version you want to view.
On the Builds > Version ## page, under Details tab, you can find the Package Name.
