Offline licenses
What an offline license is, who stores it, how long it lasts, and what your game checks.
An offline license is a small file Depot signs for one player and one game. It lists the packages that player owns. The launcher stores it on the player's computer, and the Depot SDK in your game reads it without going online.
What's in a license
- The game it's for. A license for one game never works for another.
- The player, as an opaque Depot account id. No email address or handle.
- The packages they own, by package name (such as
baseorexpansion-1), with each one's kind and end time if it has one. Bundles are already expanded into their contents. A DLC never implies the base game. - Your game's signing keys, so the SDK can check installed files against your signed release.
- When it was issued and when it expires.
- Depot's signature.
Licenses aren't tied to a device, and there's no device limit.
Who stores it
Licenses live in one per-user folder that all Depot tools share:
| OS | Folder |
|---|---|
| macOS | ~/Library/Application Support/games.depot/licenses/ |
| Windows | %APPDATA%\games.depot\licenses\ |
| Linux | $XDG_DATA_HOME/games.depot/licenses/ (usually ~/.local/share/games.depot/licenses/) |
Each game has one file, named after its game id. A file is trusted only after its signatures verify, and a newer license is never replaced by an older one.
The launcher writes licenses for the games a signed-in player owns. It refreshes them at startup, after an install, update or key redemption, and every 12 hours, renewing a license once it's a day old.
The CLI writes them too, on depot install and depot update when signed in, and on depot license refresh --game <game>. Use depot license show --game <game> to read the cached license.
Signing out of the launcher or the CLI removes the licenses that tool wrote.
How long it lasts
A license is valid for 30 days from when it was issued, or until the earliest end time of the entitlements in it, whichever comes first. The SDK allows 5 minutes of clock difference.
Players who open the launcher now and then never see a license expire, because the launcher renews it long before then.
What your game checks
When your game asks HasEntitlement("expansion-1"), the SDK:
- Reads the license file for your game id.
- Checks that Depot signed it. The SDK has Depot's root key built in for each environment, and the license carries the certificate of the key that signed it, so this works offline.
- Checks that it's for your game and that it's within its validity window.
- Looks up the package and its end time.
It answers with one of these:
| Situation | Status |
|---|---|
| Valid license, package included | Granted |
| Valid license, package not included (or its entitlement has ended) | Denied |
| No license on this computer | Unknown |
| License past its expiry | Expired |
| Online Required policy and the license is older than your freshness window | RefreshNeeded |
| File changed, signature doesn't verify, or wrong game | Error, with the reason in the snapshot's ErrorKind |
The SDK only reads files. It never contacts Depot, opens a browser or asks the player to sign in. To get a newer license, the player opens the launcher (or runs depot license refresh), and your game calls ReloadAsync.
Offline, expired and revoked
- Offline: a valid license works with no network at all, for as long as it's valid.
- Expired: the player opens the launcher while online and it fetches a new license. Decide in your game what an expired license means, for example a message asking the player to open Depot.
- Revoked: if you revoke a player's entitlement, Depot stops new downloads at once, and the next license the player gets won't include that package. A license they already have stays valid until it expires.
- Clock set back: the SDK sets
ClockAnomalyif the computer's clock looks earlier than a time it has already trusted. It's a warning only, and the SDK doesn't change its answer because of it.
What licenses don't protect against
Offline licenses are a fair, low-friction ownership check, not DRM. They don't stop someone who patches your game's code or copies the decrypted files out of an installation. They can't enforce revocation while an offline license is still valid, and they can't fully guard against a wrong clock. For multiplayer or anything valuable, check on your own server too.