In a certain spoon that starts with a G I'm not sure if the XUID is accessible unless you edit the source code yourself. Hopefully PMMP keeps usability in mind.
As far as i remember my conversation with ishityasku, the ClientId is the XUID if the user logged in with xbox
we sure should put our awesome copy and paste skills and make them obsolete!!! time to gather our keyboards!/s
This could cause serious bugs, I reckon. So it is probably best in a plugin Edit: Oh sorry @dktapps , I din't see what you said there
There are 3 things with XBOX Live implementations... 1) Getting the info from JSON into the server and using it (from a plugin) 2) Validating the JWT. 3) Using the keys from the JWT and encrypting the communication. At a minimum to get started with XBL in a server you MUST do 1. Should do 2. To secure it from MITM and replay attacks could do 3. But you get a long way with just doin 1, maybe 2.
According to shoghichip, UUID is unique if logged in via Xbox. This means that it's in a PC-like fashion.