Minecraft Services returns "Invalid app registration" after successful Microsoft OAuth, Xbox Live and XSTS authentication

Question

Minecraft Services returns "Invalid app registration" after successful Microsoft OAuth, Xbox Live and XSTS authentication

Hello,

I am developing an open-source custom Minecraft launcher with the assistance of ChatGPT for learning and research purposes.

The project is available on GitHub and aims to implement the complete Microsoft authentication flow following the official documentation and best practices.

The authentication flow is implemented as follows:

1. Microsoft OAuth 2.0 Authorization Code + PKCE
2. Xbox Live authentication
3. XSTS authorization
4. Minecraft Services authentication (/authentication/login_with_xbox)

The first three steps complete successfully.

My logs show:

Microsoft Access Token acquired.
Xbox authentication completed.
XSTS authorization completed.

The generated identityToken is in the following format:

XBL3.0 x=<userHash>;<xstsToken>

which matches the official Minecraft authentication specification.

However, when sending the following request:

POST https://api.minecraftservices.com/authentication/login_with_xbox
Content-Type: application/json

{
  "identityToken": "XBL3.0 x=<userHash>;<xstsToken>"
}

Minecraft Services always responds with:

HTTP 403 Forbidden

{
  "path": "/authentication/login_with_xbox",
  "errorMessage": "Invalid app registration, see https://aka.ms/AppRegInfo for more information"
}

Azure App Registration

• Supported account types: Any Microsoft account
• Public client flows: Enabled
• Client secret: Configured
• Redirect URI (Web): http://localhost:51825/callback
• Redirect URI (Public client): https://login.live.com/oauth20_desktop.srf

Since Microsoft OAuth, Xbox authentication, and XSTS authorization all succeed, I believe my OAuth implementation is correct.

GitHub Repository

This is the GitHub repository for my project.

GitHub: https://github.com/GUBBIB/LauncherHub

The repository contains the complete implementation of the authentication flow, including Microsoft OAuth, Xbox Live authentication, XSTS authorization, and Minecraft Services authentication.

If necessary, you are welcome to review the implementation.

My questions

1. What exactly does "Invalid app registration" mean in this context?
2. Does a new Azure App Registration require additional approval before it can access Minecraft Services?
3. Is the AppRegInfo registration process still available?
4. If so, where can I submit my application? The https://aka.ms/AppRegInfo link does not appear to provide a registration form anymore.

Thank you for your time and assistance.