AuthCore

A login form on the loading screen

On Paper 1.21.6 and newer the password is asked for before the player exists. No lobby world, nothing to hide them from, and nobody reaches the world without it. Players on an older game through ViaVersion get the in world lock instead, since their game cannot draw the form.

A real lock on every other version

Older servers have no form to show, so the player joins locked: held on the spot, blind, hidden from everybody, no chat, no commands but /login and /register, and no blocks, items, entities or damage until they log in. Blindness, hiding and the titles are each a switch in the settings.

Staff tools for every login

Force a stuck player in, on the loading screen or in the world. Give a name its first password, change one, log somebody out, erase an account or purge every account unused for months. All of it works from the console, and the actions for one player are buttons on their account screen too.

Passwords never leave AuthCore

/login, /register, /changepassword and the admin password commands are answered by AuthCore the moment they are typed, and no other plugin is ever shown them: not CoreProtect's command log, not a command spy, not a plugin that owns the same name. The server log line is taken out too, and anything a locked player types in chat is dropped before another plugin can read it.

Nobody walks in on somebody else's name

A player is held from the very first tick, so a hacked client firing commands the instant it joins runs nothing. A second connection on a name that is already playing is turned away instead of kicking them. A remembered session is never used on an address a proxy or tunnel gives everybody, or one more than one account plays from. Easy passwords are refused, and wrong guesses are capped per name per day.

Spawn points for every step

Choose where a player waits while they log in, where a brand new account lands, and where everybody lands after logging in. Leave the last one unset and they go back to where they stood, even if they quit while waiting. Set one where you stand, from the console with coordinates, or from its own screen.

Commands on every login event

Run any command on join, register, login, session login, first login, logout or unregister, as the console or as the player, after a delay, and only when enough or few enough accounts share their address. %player%, %uuid% and PlaceholderAPI placeholders all work. Edited in game, or by hand in event-commands.yml.

Paid accounts verified by Mojang

On an offline server, a paid name is put through Mojang's own login check before it joins. Real owners skip the password entirely and nobody else ever gets their id. If Mojang cannot be reached the owner is simply asked again, never let in as somebody else. A cracked game on a paid name plays as *Name and registers. Needs Paper 1.20.5 or newer; older servers ask paid names for a password instead. Works through ViaVersion.

Existing players keep their data

Add AuthCore to a server people already play on and nobody starts over: each player keeps the id their inventory, permissions and everything else was saved under, whether they turn out to be a paid owner or a cracked player.

Limits that fit your network

Wrong passwords are limited per name and per address, and new accounts per address per day. Behind a proxy or tunnel that does not pass on each player's address, every player arrives from one local address, so the per address limits leave local and private addresses alone (a switch in the settings), and the console says exactly why when it refuses a registration.

Argon2id hashing

Argon2id where the library is available, PBKDF2 as the fallback. A placeholder tells you which one this server actually ended up with.

Alt detection

See which accounts share an address, behind its own permission. Addresses never leave the admin screens and are only ever a truncated hash.

Every screen editable in game

Menus, settings and every player facing message are edited from an in game admin hub, the help list and what every command says it does included, so /auth help reads in your server's language. No file editing and no restarts.

Bedrock and skins

Bedrock players keep the name and id their bridge gives them and log in like everybody else, since a name prefix is something anybody can type. Skins are stored, and a policy decides whether paid names are verified, asked for a password or refused.