About
Sour Client is a desktop launcher and mod set for Minecraft: Java Edition 1.8.9. It launches the game you already own, on the account you already have, with performance work and quality-of-life features built in. This page explains what it does, what it touches, and what it deliberately does not do.
The product
Authentication
Sour Client uses the standard Microsoft and Xbox Live sign-in chain. You sign in to Microsoft directly, in Microsoft's own interface. The launcher never renders a password field and never handles your password.
You sign in through Microsoft's own page, either in your browser via a loopback redirect with PKCE, or by entering a device code Microsoft shows you. The launcher receives an access token and a refresh token. It never sees what you typed.
That Microsoft token is exchanged for an Xbox Live token, using the xboxlive.signin and xboxlive.offline_access scopes and nothing more.
The Xbox Live token is exchanged for an XSTS token authorised for Minecraft services.
The XSTS token is presented to Minecraft services, which confirms the account owns the game and returns your profile. If the account does not own Minecraft: Java Edition, sign-in stops here and the game does not launch.
Full detail on what is collected and retained is in the Privacy Policy.
Boundaries
The developer
Affiliation
Sour Client is an independent project. It is not approved by or associated with Mojang Studios or Microsoft. Minecraft is a trademark of Mojang Synergies AB. Sour Client does not include Minecraft, and you need to own the game to use it.