A little bit of both but mostly the latter. Currently, the way to do the latter is to make an additional call to my own server which will use my personal API key (which has access to games I create) and counter check it with the user's basic profile info