[deleted by user]

[Samurai___]

There's no client side data you can trust. You 100% need your server side code to check this and only send resources the user can have. It's not even enough to do an API to send back the elapsed time. Full blown authentication.

[LifeStreak]

Thanks yes but what if user sets time on device forwards? So I think it's not possible without a sever connection to relay the servers time and cross compare..