Various embodiments relating to validating a user's entitlement to play a game are provided. In one embodiment, a request for a user to play a game is received at a validation service. The request may include an obfuscate-encoded bundle including a signed user ID identifying the user, a signed hardware ID of a computing machine on which the game is requested to be played, and a signed receipt. The obfuscate-encoded bundle may be decoded and the request may be validated according to a plurality of security checks including determining that one or both of the signed hardware ID or the signed user ID respectively match a hardware ID and/or a user ID included in the signed receipt. If the request to play the game is valid, an authentication token may be sent to the computing machine that allows the user to play the game on the computing machine.