Messenger Application Key (Messenger Connect)

Current information about Live Connect is now available in the Windows Live Developer Center. The information in the following sections is provided for legacy purposes only.

The Messenger Application Key is used for signing application contact lists. By signing an application contact list, you can control which users are able to interact with each other in your application through the Windows Live Messenger Connect. This is recommended in applications such as social networks that have specific relationship types, such as "friends," that define the activities that can take place between users. In such cases, an application should sign application contact lists with the Messenger Application Key.

To get your Messenger Application Key, browse to the following page.{appid}

{appid} is replaced with your client ID. The {appid} parameter can be decimal or hexadecimal prefixed with '0x'.

Messenger Application Settings page.

You must sign in to this page with the same Windows Live ID that you used to create your client ID.

This page lets you get or set your application's Messenger Application Key. The Messenger Application Key is a string between 16 and 64 characters. It cannot contain whitespace or the following characters: <, >, %, ;.

You can update your Messenger Application Key at any time. If you are using a Messenger Application Key in a live application, you must update it in your application as soon as you update it in Windows Live. You should store the Messenger Application Key in a protected location because it is used to validate your requests to Messenger.

Using the Getting Started Sample

The Getting Started with Messenger Connect in the Windows Live Messenger Connect includes a link to the Messenger Application Key settings page for your application.

By default, applications that use the Windows Live Messenger Connect must sign an Application Contact List (Messenger Connect) with the Messenger Application Key.

Optionally, the Windows Live Messenger Connect enables applications to omit signing application contact lists. If your application lets any user interact with any other user, then you can choose this option in the Messenger Application Key page.

If you omit application contact list signatures, then any script or debugger that can modify your page can modify the application contact lists of your application. This may lead to users seeing the presence of other users and being able to instant message users outside of the control of your application.

If you choose to omit application contact list signatures and use UI Controls, your application does not have to define application contact lists with the User.ApplicationContacts property, the application-contacts tag, or the application-contact tag. Instead, any CID that you reference in UI Controls is placed in the user's application contact list automatically.