Minecraft Services returns HTTP 403 "Invalid app registration" for HyperKraft third-party Java launcher

Question

Hello Microsoft / Minecraft Services team,

I am developing HyperKraft Launcher, an independent Windows desktop launcher for Minecraft: Java Edition.

HyperKraft uses its own Microsoft Entra public-client application. I am not reusing the Client ID of Minecraft Launcher, Prism Launcher, Modrinth App, or any other third-party launcher.

The authentication chain currently succeeds through:

Microsoft OAuth 2.0 Device Authorization Grant — SUCCESS Xbox Live authentication — SUCCESS XSTS authorization — SUCCESS Minecraft Services /authentication/login_with_xbox — HTTP 403 Invalid app registration

The error returned by Minecraft Services references:

https://aka.ms/AppRegInfo

Application details:

• Application: HyperKraft Launcher
• Platform: Windows desktop
• Client type: public/native client
• Account type: Personal Microsoft accounts
• Public client flows: Enabled
• Authentication flow: OAuth 2.0 Device Authorization Grant
• Entra Client ID: <FIRST_4_CHARS>...<LAST_4_CHARS>
• Public release page: https://github.com/Hadeverl4/HyperKraft-Releases

Because Microsoft OAuth, Xbox Live, and XSTS all succeed, the failure occurs specifically when Minecraft Services evaluates the HyperKraft application registration.

I am not asking for help debugging the launcher. I am trying to identify the current official process/team that authorizes third-party application Client IDs for Minecraft Services.

Could you please clarify:

1. Which team currently manages Minecraft Services Client ID authorization/allowlisting?
2. Is there still an official registration process for independent Minecraft: Java Edition launchers?
3. Is aka.ms/AppRegInfo still an active application process?
4. If ID@Xbox cannot handle Minecraft Services authorization, where should an independent launcher developer submit their Client ID for review?

I can provide a full Client ID privately if required, along with a sanitized UTC timestamp and request/correlation IDs from a fresh reproduction.

I will not provide OAuth access/refresh tokens, device codes, Xbox/XSTS tokens, Minecraft bearer tokens, account credentials, or DPAPI credential data.

Thank you for helping route this request to the team responsible for Minecraft Services application authorization.