Documentation

AuthCore

Standalone login and registration, fully configurable in game.

v1.4.31.14 - 26.2Spigot / PaperFolia supportedReleased

AuthCore locks an offline mode server behind a password without dragging in a login plugin from a decade ago. Players register once, log in when they join, and every screen they see is editable in game.

It knows the difference between a paid account and a name somebody typed. When a name belongs to a paid account, AuthCore has Mojang prove that this player really owns it, the same check an online mode server runs, even though your server stays in offline mode. The owner gets in instantly as themselves, with their real id and skin and no password, and nobody else ever gets that account's id: a cracked player who happens to use a paid account's name plays as *Name and registers like any other cracked player. Players who were already on your server before AuthCore keep their inventory, permissions and everything else.

How the password is asked for depends on the server. On Paper 1.21.6 and newer it is a form on the loading screen, before the player exists in the world. Everywhere else the loading screen cannot show a form, so the player joins and is locked: held on the spot, blinded, hidden, and unable to chat, run a command or touch anything until they type /login or /register. Both are the real login, not one of them a fallback. A player on an older game joining a new server through ViaVersion cannot see the form either, so they are let into the lock and log in with the command instead of waiting on a loading screen that never changes.

Staff can sort out any login without knowing the password: log a stuck player in, give a name its first password, change or clear one, log somebody out, erase one account or every account nobody has used in months. And the passwords players type never end up in the server log.

What it does

A login form on the loading screen

On Paper 1.21.6 and newer the password is asked for before the player exists. No lobby world, nothing to hide them from, and nobody reaches the world without it. Players on an older game through ViaVersion get the in world lock instead, since their game cannot draw the form.

A real lock on every other version

Older servers have no form to show, so the player joins locked: held on the spot, blind, hidden from everybody, no chat, no commands but /login and /register, and no blocks, items, entities or damage until they log in. Blindness, hiding and the titles are each a switch in the settings.

Staff tools for every login

Force a stuck player in, on the loading screen or in the world. Give a name its first password, change one, log somebody out, erase an account or purge every account unused for months. All of it works from the console, and the actions for one player are buttons on their account screen too.

Passwords never leave AuthCore

/login, /register, /changepassword and the admin password commands are answered by AuthCore the moment they are typed, and no other plugin is ever shown them: not CoreProtect's command log, not a command spy, not a plugin that owns the same name. The server log line is taken out too, and anything a locked player types in chat is dropped before another plugin can read it.

Nobody walks in on somebody else's name

A player is held from the very first tick, so a hacked client firing commands the instant it joins runs nothing. A second connection on a name that is already playing is turned away instead of kicking them. A remembered session is never used on an address a proxy or tunnel gives everybody, or one more than one account plays from. Easy passwords are refused, and wrong guesses are capped per name per day.

Spawn points for every step

Choose where a player waits while they log in, where a brand new account lands, and where everybody lands after logging in. Leave the last one unset and they go back to where they stood, even if they quit while waiting. Set one where you stand, from the console with coordinates, or from its own screen.

Commands on every login event

Run any command on join, register, login, session login, first login, logout or unregister, as the console or as the player, after a delay, and only when enough or few enough accounts share their address. %player%, %uuid% and PlaceholderAPI placeholders all work. Edited in game, or by hand in event-commands.yml.

Paid accounts verified by Mojang

On an offline server, a paid name is put through Mojang's own login check before it joins. Real owners skip the password entirely and nobody else ever gets their id. If Mojang cannot be reached the owner is simply asked again, never let in as somebody else. A cracked game on a paid name plays as *Name and registers. Needs Paper 1.20.5 or newer; older servers ask paid names for a password instead. Works through ViaVersion.

Existing players keep their data

Add AuthCore to a server people already play on and nobody starts over: each player keeps the id their inventory, permissions and everything else was saved under, whether they turn out to be a paid owner or a cracked player.

Limits that fit your network

Wrong passwords are limited per name and per address, and new accounts per address per day. Behind a proxy or tunnel that does not pass on each player's address, every player arrives from one local address, so the per address limits leave local and private addresses alone (a switch in the settings), and the console says exactly why when it refuses a registration.

Argon2id hashing

Argon2id where the library is available, PBKDF2 as the fallback. A placeholder tells you which one this server actually ended up with.

Alt detection

See which accounts share an address, behind its own permission. Addresses never leave the admin screens and are only ever a truncated hash.

Every screen editable in game

Menus, settings and every player facing message are edited from an in game admin hub, the help list and what every command says it does included, so /auth help reads in your server's language. No file editing and no restarts.

Bedrock and skins

Bedrock players keep the name and id their bridge gives them and log in like everybody else, since a name prefix is something anybody can type. Skins are stored, and a policy decides whether paid names are verified, asked for a password or refused.

Installation

Drop AuthCore.jar into your server's plugins folder.
Restart the server. The plugin writes its own configuration on first start.
Run /auth admin hub in game to set everything up. There is no file editing step.

iEverything ships in one jar. The shared framework is shaded in, so AuthCore does not depend on any other Core plugin and any number of them run side by side.

Optional integrations

All of these are soft dependencies. AuthCore loads and runs with none of them installed.

Plugin	What it adds
PlaceholderAPI	Registers the placeholder expansion listed below.
ViaVersion	Optional integration.

Commands

Generated from the plugin's own command registry at version 1.4.3, so this list cannot drift out of date.

/loginLog in/l

Requires authcore.login

Usage

Usage	Permission	Description
/login <password>	none	Log in

/registerRegister this name/reg

Requires authcore.register

Usage

Usage	Permission	Description
/register <password> <password again>	none	Register this name

/changepasswordChange your password/changepass

Requires authcore.changepassword

Usage

Usage	Permission	Description
/changepassword <current> <new>	none	Change your password

/logoutLog out

Requires authcore.logout

Usage

Usage	Permission	Description
/logout	authcore.logout	Log out

/authAuthCore administration

Requires authcore.admin

Usage

Usage	Permission	Description
/auth	authcore.admin	AuthCore administration

Subcommands

Usage	Permission	Player only	Description
/auth admin <action> [player] [value]	authcore.admin	no	Administration

/auth admin actions

Usage	Permission	Description
/auth admin hub	authcore.admin	Open the admin hub
/auth admin accounts	authcore.admin	Open the account list
/auth admin status	authcore.admin	Show what the plugin is doing
/auth admin info <player>	authcore.admin	Everything recorded about one account
/auth admin recent [count]	authcore.admin	Who joined most recently
/auth admin forcelogin <player>	authcore.admin.forcelogin	Log somebody in without their password, in the world or on the loading screen
/auth admin forcelogout <player>	authcore.admin.forcelogout	Log somebody out, so they have to log in again to keep playing
/auth admin forceregister <player> <password>	authcore.admin.forceregister	Give a password to a name that has none, and let them in if they are waiting
/auth admin setpassword <player> <password>	authcore.admin.setpassword	Change the password on somebody else's account
/auth admin reset <player>	authcore.admin.reset	Clear somebody's password
/auth admin delete <player>	authcore.admin.delete	Erase one account and everything recorded about it
/auth admin purge <days> [confirm]	authcore.admin.purge	Erase every account nobody has joined on in that many days, confirm to go through with it
/auth admin alts <player>	authcore.admin.alts	Accounts sharing an address
/auth admin premium <player>	authcore.admin.premium	Ask whether a name is a paid account
/auth admin spawns	authcore.admin.spawns	Open the spawn points screen
/auth admin events	authcore.admin.events	Open the event commands screen
/auth admin setspawn <spot> [world] [x] [y] [z]	authcore.admin.spawns	Set a spawn point to where you stand, or to a world and coordinates
/auth admin clearspawn <spot>	authcore.admin.spawns	Clear a spawn point so nobody is sent there
/auth admin spawn <spot>	authcore.admin.spawns	Teleport to a spawn point
/auth admin menus	authcore.admin.menus	Edit any menu in game
/auth admin settings	authcore.admin.settings	Edit the settings in game
/auth admin messages	authcore.admin.settings	Edit any player facing message
/auth admin updates	authcore.admin	Say what version this is and whether a newer one is out
/auth admin reload	authcore.admin.reload	Reload the configuration

Permissions

everyone is granted to all players, operator only to ops, and nobody must be granted explicitly by a permissions plugin.

Node	Default	Description
authcore.*	operator	Grants every authcore permission
authcore.admin	operator	Administration
authcore.admin.alts	operator	See which accounts share an address
authcore.admin.delete	operator	Erase one account and everything recorded about it
authcore.admin.events	operator	Edit the commands that run when somebody joins, logs in or logs out
authcore.admin.forcelogin	operator	Log somebody in without their password
authcore.admin.forcelogout	operator	Log somebody out
authcore.admin.forceregister	operator	Give a password to a name that has none
authcore.admin.menus	operator	Edit the menus in game
authcore.admin.premium	operator	Ask whether a name is a paid account
authcore.admin.purge	operator	Erase every account not seen in a while
authcore.admin.reload	operator	Reload the configuration
authcore.admin.reset	operator	Clear somebody's password
authcore.admin.setpassword	operator	Change the password on somebody else's account
authcore.admin.settings	operator	Edit the settings in game
authcore.admin.spawns	operator	Set, clear and visit the spawn points players log in around
authcore.changepassword	everyone	Change your own password
authcore.login	everyone	Log in
authcore.logout	everyone	Log yourself out
authcore.register	everyone	Register a name

Placeholders

Requires PlaceholderAPI. AuthCore registers the identifier authcore on start and says so in the log. Without PlaceholderAPI installed nothing here resolves and the plugin still works.

No placeholder ever returns an address. A placeholder ends up in scoreboards, tab lists and chat formats that everybody can read, and who else plays from this house is not something a server should print to the room.

Per player

Each of these needs a player and resolves to nothing when asked without one.

Placeholder	Notes
%authcore_registered%	true when this name has a password set
%authcore_logged_in%	true when they are past the lock and playing
%authcore_session%	true when a remembered session is open for the name
%authcore_addresses%	how many addresses this account has connected from
%authcore_alts%	how many other accounts share an address with this one
%authcore_last_seen%	when they last logged in, as a millisecond timestamp

Server wide

These answer with or without a player, which is what makes them usable on a lobby board.

Placeholder	Notes
%authcore_accounts%	how many accounts exist
%authcore_registered_count%	how many of them have a password
%authcore_pending%	how many players are sitting at the lock right now
%authcore_required%	true when the lock is active, false on an online mode server
%authcore_hashing%	argon2id or pbkdf2, whichever this server ended up with

Worth knowing

The last seen key is raw so you can feed it to whatever date formatter your other plugins already use. The account screens format it themselves.

The hashing key is worth putting on an admin board once. If it ever reads pbkdf2 on a server that should have Argon2, the library did not download and the log will say so.

There is deliberately no address, ip or ip hash placeholder. The addresses themselves live in the admin screens behind authcore.admin.alts, and even there they are only ever the truncated hash.