# Do we have to "pay" to develop third party applications built on ESI? **URL:** \ **Category:** Third Party Developers\ **Created:** [October 26, 2021, 9:14am UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153 "2021-10-26T09:14:41Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 1:27pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/21 "2021-10-27T13:27:57Z")
Gotcha. Another option is if this is a local app specific to a single character (or multiple characters belonging to a single human) you could just have them create their own dev application and plug in the client and secret keys. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 1:28pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/22 "2021-10-27T13:28:34Z")
> [@Blacksmoke16](#): > > you could just have them create their own dev application and plug in the client and secret keys. Lol wut? You want me to tell the user to go dev their own app and get a secret key? Lol. What’s the point then? ---
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 1:29pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/23 "2021-10-27T13:29:55Z")
No, I said go create a dev app for themselves and plug in the client and secret keys into your application. I.e. this way each “instance” of your application is specific to each user. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 1:30pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/24 "2021-10-27T13:30:29Z")
That’s not going to work and be practical is it. I wasn’t asked to do that for EveMon on Windows was I yet I have to SSO my characters in. Do I need a secret key if I wanted to build something like that? ---
**Author:** ![Rihan\_Shazih](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/rihan_shazih/32/406992_2.png) [@Rihan\_Shazih](https://forums.eveonline.com/u/Rihan_Shazih)\ **Post date:** [October 27, 2021, 1:30pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/25 "2021-10-27T13:30:53Z")
🍿 Maybe it’s easier if you just file a support ticket with CCP? ---
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 1:33pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/26 "2021-10-27T13:33:43Z")
> [@Zoiie](#): > > That’s not going to work and be practical is it. It’s a solid workaround if you don’t want to pay and still develop your application. > [@Zoiie](#): > > I wasn’t asked to do that for EveMon on Windows was I yet I have to SSO my characters in. No because they paid and registered a single dev app for the project. Of which of course the dev app is not specific to a specific OS or something. I.e. if you were to get EveMon working on Linux, it would work just the same from an SSO perspective. > [@Zoiie](#): > > Do I need a secret key if I wanted to build something like that? You need a dev app if you want to do _anything_ with non-public character information. I.e. anything that requires them to SSO. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 1:34pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/27 "2021-10-27T13:34:19Z")
What is the point of SSO if I have to also get a key, the user of the applicaiton is responsible for their keys and application usage. I am not responsible for the users of the application. The control stays with them. ---
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 1:43pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/28 "2021-10-27T13:43:08Z")
> [@Zoiie](#): > > What is the point of SSO if I have to also get a key, the user of the applicaiton is responsible for their keys and application usage. To be clear, EVE ESI follows an OAUth2 flow, of which the dev application’s keys are used for this. See [SSO | esi-docs](https://docs.esi.evetech.net/docs/sso). There are no API keys or anything like the XML API of late. > [@Zoiie](#): > > the user of the applicaiton is responsible for their keys and application usage. The user uses your application but is usually never aware of the tokens used to access their data. All they do is go an SSO flow much like if you were to login to the EVE mobile app, or that you used to log into the forums. I.e. they only ever really interact with your application. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 1:45pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/29 "2021-10-27T13:45:04Z")
From Evemon license, not even they want to be responsible for the users. You will find every piece of software does this. ![image](https://global.discourse-cdn.com/eveonline/original/4X/4/b/7/4b78bdcdfb77bf2ca8f823d6575fcb3423679733.png) I as a developer am NOT responsible for the users use of the application. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 1:53pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/30 "2021-10-27T13:53:21Z")
So we have to ship the secret key with every release of our application? You have to be bonkers if that is the case. Doesn’t that risk capture and replay? What’s to stop one application impersonating another dev key? ---
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 2:08pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/31 "2021-10-27T14:08:30Z")
> [@Zoiie](#): > > So we have to ship the secret key with every release of our application? Ideally you wouldn’t no, for the reasons you mentioned. How to handle this depends on what type of application you have. Given it sounds like you’re making a desktop app checkout [OAuth 2.0 for Mobile or Desktop Applications | esi-docs](https://docs.esi.evetech.net/docs/sso/native_sso_flow.html) for how to handle that. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 2:12pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/32 "2021-10-27T14:12:43Z")
Thanks, however, this “dev key” still implies liability and responsibility for the users of the application, also some people prefer to build from source themselves then run, especially on Linux and BSD platforms where they would also sign their known reviewed build of the app, including their own modifications. ---
**Author:** ![Blacksmoke16](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/blacksmoke16/32/376589_2.png) [@Blacksmoke16](https://forums.eveonline.com/u/Blacksmoke16)\ **Post date:** [October 27, 2021, 2:16pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/33 "2021-10-27T14:16:58Z")
> [@Zoiie](#): > > also some people prefer to build from source themselves then run, especially on Linux and BSD platforms where they would also sign their known reviewed build of the app, including their own modifications. This relates to: > [@Blacksmoke16](#): > > just have them create their own dev application and plug in the client and secret keys. Ideally your application would be designed in such a way where those keys are not hard-coded in the application. I.e. provided via ENV vars. This way, other people could plugin in their own keys in order to test changes, or run their own fork of it. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 2:18pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/34 "2021-10-27T14:18:26Z")
So basically back to the API key method again. We just went full circle, just with more headaches. ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 2:21pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/35 "2021-10-27T14:21:46Z")
It’s also possible to proxy manipulate an existing binary built application on the traffic, also it’s possible to edit the binary parameters in memory or in the release binary executable file. There’s no escaping possible manipulation and abusing this dev key. ---
**Author:** ![Golden\_Gnu](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/golden_gnu/32/459734_2.png) [@Golden\_Gnu](https://forums.eveonline.com/u/Golden_Gnu)\ **Post date:** [October 27, 2021, 4:51pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/36 "2021-10-27T16:51:35Z")
Just want to touch on your point that about legal agreement of playing eve vs using ESI. The gap between the twos ability to hurt the eve server, if people are doing bad stuff, is huge. A single client made by CCP them self vs endpoints that goes directly to the servers, isn’t really a comparison. The reason you can use the public endpoints scot free, is that they’re cached by the cloud and not CCP, making the risk and cost much lower. I think you’re heavily overthinking this. I have developed jEveAssets since 2009, a desktop application, I have never had any problems with CCP regarding the ESI license. All I do is abide by all the rules of using ESI, As long as you do too, you will be fine. I also thing you underestimating CCPs willingness to allow you to explain yourself. No system is foolproof ofc. But, the ESI license turned out to not really be a bad thing… ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 5:02pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/37 "2021-10-27T17:02:57Z")
A license and terms is one thing, having to manage a developer key is another. The responsibility is on the user for usage. The key should be managed by the user. It should be a user key, and only a user key. ---
**Author:** ![Golden\_Gnu](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/golden_gnu/32/459734_2.png) [@Golden\_Gnu](https://forums.eveonline.com/u/Golden_Gnu)\ **Post date:** [October 27, 2021, 5:15pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/38 "2021-10-27T17:15:37Z")
The user and developer share the responsibility. It’s the developers responsibility that their software doesn’t break any rules, It’s the users responsibility to use the software as intended and not modify it to break the rules. It’s feels really simple to me… Like if one person is misusing your software ofc. it won’t be on you, that just, you know, makes sense… ---
**Author:** ![Zoiie](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zoiie/32/292363_2.png) [@Zoiie](https://forums.eveonline.com/u/Zoiie)\ **Post date:** [October 27, 2021, 5:15pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/39 "2021-10-27T17:15:43Z")
![image](https://global.discourse-cdn.com/eveonline/original/4X/4/b/7/4b78bdcdfb77bf2ca8f823d6575fcb3423679733.png) EveMon state this clearly, they do not take liability for the application’s use. Having to use a developer key ESI implies liability for use. It is a contradiction in terms. ---
**Author:** ![Golden\_Gnu](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/golden_gnu/32/459734_2.png) [@Golden\_Gnu](https://forums.eveonline.com/u/Golden_Gnu)\ **Post date:** [October 27, 2021, 5:17pm UTC](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153/40 "2021-10-27T17:17:47Z")
They’re still have liability to CCP, the agreement in the screenshot is with the user, not CCP. The agreement with CCP is the ESI license, they agreed to that. [Previous page](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153.md?page=1) [Next page](https://forums.eveonline.com/t/do-we-have-to-pay-to-develop-third-party-applications-built-on-esi/334153.md?page=3)