FloodPass

Floodgate Auto Login for AuthMe — passwordless Bedrock sign-in: Xbox-verified, automatic, zero typing

简体中文

Official AuthMe only. FloodPass is built for the original AuthMeReloaded (5.x / 6.x). Do not install it on forks that already ship native Floodgate auto-login (such as AuthMeReReloaded) — the feature would run twice.

What It Does

Cross-play servers usually protect survival accounts with AuthMe. That works well for Java players, but Bedrock players arriving through Geyser + Floodgate have already proven who they are: they signed in with their Microsoft/Xbox account before the connection was even established. Forcing them to type a password with a gamepad keyboard adds no security and a lot of friction.

FloodPass closes that gap:

• For Bedrock players: nothing to type, ever. Registered accounts are signed in automatically about a second after joining; brand-new players are registered silently with a random password and signed in the same way
• For Java players: zero change, they go through AuthMe exactly as before
• Prefix-friendly: Bedrock names carrying the Floodgate prefix (for example .Steve) pass AuthMe's default allowedNicknameCharacters regex with no AuthMe config change — only genuine Floodgate UUIDs are exempt
• Premium coexistence: a Bedrock player whose gamertag equals a premium-enrolled Java account (AuthMe 6.x /premium + PacketEvents) joins normally while the Java account keeps its passwordless premium login
• For server owners: one jar, no AuthMe configuration changes, one command to manage everything; the trust decision stays where it belongs (Floodgate's Xbox Live verification)

How It Works

1. A player joins; FloodPass listens at MONITOR priority, by which time Floodgate identity data for the connection is available
2. FloodgateApi#isFloodgatePlayer(uuid) decides whether this is a genuine Bedrock connection; Java players are never touched
3. After a configurable delay (20 ticks by default), AuthMe has finished its own join processing, and FloodPass takes over:
   • Registered player: AuthMeApi#forceLogin signs the account in without a password
   • Unregistered player (if auto-register is on): AuthMeApi#forceRegister registers the account with a random password and signs it in immediately

Security basis: a Floodgate identity only exists after the Bedrock client completed Floodgate's encrypted handshake with a valid Xbox Live token. A Java Edition client cannot forge that identity, so the passwordless path is only ever offered to players Microsoft has already verified.

Compatibility

Component	Requirement	Notes
Server	Spigot / Paper / Purpur / Folia 1.13+	Java 8 bytecode; older legacy servers (1.8+) generally load it too, untested
Folia	Supported	Per-entity scheduler via reflection, global scheduler fallback elsewhere
Java	8+	The JVM floor is usually raised by AuthMe/Floodgate builds, not by FloodPass
AuthMe	5.2+ (v3 API)	Official AuthMeReloaded only; tested against 5.6.x and 6.0.x. Not for forks with built-in Bedrock auto-login
Floodgate	2.x	Required at load time

Dependencies

Plugin	Required	Version	Purpose
Floodgate	Required	2.x	Verifies Bedrock players through Xbox Live; the trust basis of every FloodPass feature
AuthMe (official AuthMeReloaded)	Required	5.2+	The login plugin FloodPass signs Bedrock players into; forks with built-in Bedrock auto-login are not supported
PacketEvents	Optional	2.x	Only needed when AuthMe 6.x premium verification (enablePremium) is used; enables the premium name-collision guard

Geyser itself is not a plugin dependency of FloodPass — Bedrock connectivity can come from any Geyser setup (standalone or proxy), but the Floodgate plugin must run on this server.

Installation

1. Install and configure Geyser and Floodgate (2.x) so Bedrock players can join
2. Install AuthMe (5.2+); configure it as usual for your Java players
3. Drop FloodPass-x.x.x.jar into plugins/ and restart the server
4. Done. No AuthMe settings need to change; both bundled language files are extracted on first start

Verify with a Bedrock account: first join should say "Registered and signed in automatically", the next join "Signed in automatically".

Commands and Permissions

Command	Permission	Description
/floodpass	floodpass.admin (default OP)	Show status (enabled, delay, auto-register)
/floodpass reload	floodpass.admin	Reload config.yml and the active language file

Alias: /fpass

Configuration

Option	Default	Description
enabled	true	Master switch for automatic sign-in
login-delay-ticks	20	Ticks to wait after join before signing in; keep at 10 or above
auto-register.enabled	true	Register first-time Bedrock players automatically; disable to use AuthMe's normal registration flow
auto-register.password-length	32	Length of the random registration password (8-64); Bedrock players never need to know it
bypass-nickname-check	true	Re-allow Bedrock players denied at pre-login by AuthMe's allowedNicknameCharacters regex; only genuine Floodgate UUIDs are exempt, Java players are still checked
premium-conflict-guard	true	Let Bedrock players join when their gamertag equals a premium-enrolled Java account (AuthMe 6.x + PacketEvents); rewrites the login-packet username of verified Floodgate connections so AuthMe's premium challenge skips them
debug	false	Console logging of every sign-in decision

Messages support & color codes; setting a message to an empty string disables it.

Known Limitations

• Bedrock accounts are stored under their Floodgate-prefixed name (for example .Steve with the default prefix). Changing the Floodgate username prefix later breaks the name mapping for existing accounts and requires an AuthMe database migration
• bypass-nickname-check recognizes AuthMe's deny by the pattern embedded in its kick message; if you customize AuthMe's invalid_name_characters message, keep the %reg tag so detection continues to work
• With an empty Floodgate username-prefix the premium conflict guard cannot tell the two identities apart — and AuthMe itself would store both accounts under the same name, which is unsupported
• AuthMe's nickname length limits (maxNickLength, default 20) are not bypassed; prefixed Bedrock names (prefix + 16-char gamertag = 17 max) fit the default
• forceLogin bypasses AuthMe's two-factor authentication for Bedrock accounts. For an Xbox-verified identity this is the intended behavior, but be aware it applies to Bedrock accounts with 2FA enabled as well
• On AuthMe 6.x with the experimental dialog login UI (Minecraft 1.21.6+), a Bedrock player may see the login dialog flash briefly before the delayed auto sign-in completes
• AuthMe's /premium command targets Java accounts and is safely rejected for regular Bedrock players (their Floodgate-prefixed name matches no Mojang account); Bedrock players do not need it — FloodPass already signs them in, and premium-conflict-guard keeps gamertags colliding with premium accounts joinable

Support

• Issues: https://github.com/Dalict/FloodPass/issues
• Source: https://github.com/Dalict/FloodPass
• License: MIT