AuthMeReloaded

"The best authentication plugin for the Bukkit modding API!"

Description

Prevent username stealing on your server! Use it to secure your Offline mode server or to increase your Online mode server's protection!

AuthMeReloaded disallows players who aren't authenticated to do actions like placing blocks, moving, typing commands or using the inventory. It can also kick players with uncommonly long or short player names or kick players from banned countries.

With the Session Login feature, you don't have to execute the authentication command every time you connect to the server! Each command and every feature can be enabled or disabled from our well-structured configuration file.

You can also create your own translation file and, if you want, you can share it with us! :)

Features:

• Dedicated builds for Spigot Legacy (1.16–1.19), Spigot 1.21 (1.20–1.21), Paper 1.21+, and Folia 1.21+
• Native proxy plugins for BungeeCord and Velocity
• E-Mail Recovery System!
• Username spoofing protection.
• Countries Whitelist/Blacklist! (country codes)
• Built-in AntiBot System!
• ForceLogin Feature: Admins can login with all account via console command!
• Avoid the "Logged in from another location" message!
• Two-factor (2FA) support!
• Session Login!
• Messages served in each player's own Minecraft client language, with server-language fallback
• Editable translations and messages!
• MySQL, MariaDB, PostgreSQL and SQLite Backend support!
• Supported password encryption algorithms: SHA256, ARGON2, BCRYPT, PBKDF2, PBKDF2BASE64 — full list
• Supports hashes from external systems for zero-downtime migration (XFBCRYPT, MYBB, PHPBB, JOOMLA, WORDPRESS, WBB3/WBB4, IPB3, and more)
• Custom MySQL tables/columns names (useful with forum databases)
• Cached database queries!
• Fully compatible with Citizens2, CombatTag, CombatTagPlus!
• Graphical login/register dialogs, with optional Paper/Folia pre-join dialogs
• Restricted users (associate a username with an IP)
• Protect player's inventory until correct authentication (requires PacketEvents)
• Premium bypass: Mojang-account holders skip password auth (requires PacketEvents)
• Saves the quit location of the player
• Ender pearls thrown before authentication are returned to the player on login
• Separate timeouts for login and registration
• Email address confirmation required before saving on /email add and /email change
• Automatic database backup
• Available languages: translations
• Account importers for Auth+, LibreLogin, LimboAuth, nLogin, OpeNLogin, tiAuth — and built-in SQLite ↔ MySQL/MariaDB/PostgreSQL migration.

Configuration

How to configure AuthMe

Dialog UI

AuthMe can display graphical login/register dialogs instead of chat-based prompts.

• settings.registration.dialog.postJoin.enable enables the post-join dialog flow.
• settings.registration.dialog.preJoin.enable enables the pre-join dialog flow on Paper/Folia.
• Both options are independent: you can enable either one, both, or neither.
• Pre-join dialogs currently require modern dialog-capable server versions such as Paper/Folia 1.21.11+.
• Verified premium players skip the pre-join dialog entirely when premium bypass is enabled.

Premium bypass

AuthMe can let players with a legitimate Mojang account skip password authentication entirely. Identity is verified via a cryptographic handshake with Mojang's session server during the Minecraft login phase — no password prompt is ever shown.

• Enable with settings.enablePremium: true in config.yml.
• Players opt in with /premium and out with /freemium (must be logged in). Admins can enrol or remove players with /authme premium <player> / /authme freemium <player>.
• Direct-connection (offline-mode, no proxy): requires PacketEvents 2.x. Without it, premium bypass is disabled at startup (fail-closed).
• Behind an online-mode proxy (Velocity / BungeeCord): the proxy authenticates with Mojang and forwards the verified UUID — no PacketEvents needed on the backend. Set Hooks.bungeecord: true on the backend.
• Behind an offline-mode proxy: install authme-velocity or authme-bungee on the proxy; premium players are authenticated per-player by the proxy and the verified UUID is forwarded to the backend.
• Full documentation: docs/premium.md

Commands

Command list and usage

Permissions

• authme.player.* - for all user commands
• authme.admin.* - for all admin commands
• List of all permission nodes

How To

• How to use the account importers (Auth+, LibreLogin, LimboAuth, nLogin, OpeNLogin, tiAuth)
• Website integration
• Convert between database types (e.g. SQLite to MySQL): /authme converter sqliteToSql

Links and Contacts

• Support:

  • GitHub issue tracker
  • Discord
  • BukkitDev page
  • Spigot page

• Dev resources:

  • JavaDocs

  • Maven Repository

    <repositories>
        <repository>
            <id>codemc-repo</id>
            <url>https://repo.codemc.org/repository/maven-public/</url>
        </repository>
    </repositories>
    
    <dependencies>
        <dependency>
            <groupId>fr.xephi</groupId>
            <artifactId>authme-core</artifactId>
            <version>6.0.1</version>
            <scope>provided</scope>
        </dependency>
    </dependencies>

• Statistics:

Requirements

Compiling requirements:

• JDK 17+ for authme-core, authme-tools, and authme-spigot-legacy
• JDK 21+ for the full multi-module build (authme-bungee, authme-spigot-1.21, authme-paper-common, authme-paper, authme-folia, authme-velocity)
• Maven (3.8.8+)
• Git/GitHub (Optional)

How to compile the project:

• Clone the project with Git/GitHub
• Execute command mvn clean package
• With JDK 17, Maven builds only the Java 17-compatible modules
• With JDK 21+, Maven builds the full reactor
• Build and tooling command reference: docs/build.md

Running requirements:

• Use the jar matching your server platform/version:
• Java 17+: AuthMe-*-Spigot-Legacy.jar — Spigot 1.16.x – 1.19.x
• Java 21+: AuthMe-*-Spigot-1.21.jar — Spigot 1.20.x – 1.21.x
• Java 21+: AuthMe-*-Paper.jar — Paper 1.21+
• Java 21+: AuthMe-*-Folia.jar — Folia 1.21+
• Java 21+: AuthMe-*-Bungee.jar — BungeeCord / Waterfall proxy (1.19 API)
• Java 21+: AuthMe-*-Velocity.jar — Velocity 3.4+ proxy
• PacketEvents 2.x (optional plugin; required for inventory protection, tab-complete blocking, and premium bypass in direct-connection mode)

Credits

Contributors:

Team members: developers, translators

Credits for the old version of the plugin: d4rkwarriors, fabe1337, Whoami2 and pomo4ka

Thanks also to: AS1LV3RN1NJA, Hoeze and eprimex

GeoIP License:

This product uses data from the GeoLite API created by MaxMind, available at https://www.maxmind.com