PAL — Player Advanced Login

PAL is a free, open-source authentication plugin for Bukkit-compatible Minecraft servers. It covers account registration, password login, premium identity handling, Bedrock identity support, sessions, pre-auth restrictions, migrations, placeholders, LuckPerms contexts and optional proxy session bridging.

Beta notice: PAL 0.1.0 is intended for staging and controlled beta networks. Test it with your exact server stack and keep database/config backups before using it on a public production network.

What PAL does

PAL protects your server before authentication is complete. Players without a verified premium identity register and log in with a password, premium players are trusted only when ownership is actually verified, and Bedrock players are detected through Floodgate/Geyser.

It is designed for both small single-server setups and larger proxy networks. On a single server, PAL can run with SQLite. On a network, PAL can sync signed sessions through Redis or a shared SQL database with the optional PAL Proxy addon.

PAL is an authentication and account-security plugin. It does not provide, promote or endorse pirated copies of Minecraft, and it does not bypass any Mojang or Microsoft ownership check.

Main features

• Password account registration and login.
• Premium auto-login through verified sources only: Bukkit online-mode, FastLogin, or PAL Proxy login-phase verification.
• Bedrock identity handling through Floodgate/Geyser.
• Hybrid premium and password account behavior for offline-mode networks.
• PBKDF2-SHA256 password hashing with automatic rehash on login.
• Configurable password policy: length limits, username blocking, common-password blocking and repeated registration confirmation.
• Persistent auth sessions with optional IP and username binding.
• TOTP two-factor authentication with backup recovery codes.
• Pre-auth restrictions for movement, chat, commands, inventory, drops, pickups, damage, block actions and teleports.
• Logical AUTH, LOBBY and LIMBO realms with separate restrictions, spawn points and effects.
• SQLite, MySQL, MariaDB and PostgreSQL storage.
• Redis or shared SQL bridge for network sessions.
• Importers for AuthMe, nLogin, OpeNLogin, LibreLogin, LoginSecurity and FastLogin.
• PlaceholderAPI expansion.
• LuckPerms runtime contexts.
• Bukkit API events for account and session lifecycle changes.
• Fully configurable commands, aliases, permissions and messages.

Supported integrations

• FastLogin — verified premium login decisions.
• Floodgate/Geyser — Bedrock identity detection.
• PlaceholderAPI — %pal_*% placeholders.
• LuckPerms — auth/session/storage runtime contexts.
• PAL Proxy — Velocity/BungeeCord network guarding and session handoff.

Player commands

Admin commands

The admin root command is /pal, with /palauth as an alias.

• /pal info
• /pal reload
• /pal help
• /pal account <player>
• /pal session <player>
• /pal session clear <player>
• /pal force-login <player>
• /pal force-logout <player>
• /pal reset-password <player> <password>
• /pal unregister <player>
• /pal migrate <provider>
• /pal migrate all

Admin permissions are split by action, including pal.admin, pal.admin.reload, pal.admin.session, pal.admin.force-login, pal.admin.force-logout, pal.admin.reset-password, pal.admin.unregister and pal.admin.migrate.

Placeholders and contexts

PAL includes PlaceholderAPI values such as authentication state, session source, session expiry, 2FA state, bridge mode, storage type, FastLogin availability and Floodgate availability.

When LuckPerms is installed, PAL can expose contexts such as:

• pal:authenticated
• pal:session_source
• pal:2fa_pending
• pal:bridge_mode
• pal:storage_type

Installation

Single server

1. Put PAL-<version>.jar in your Bukkit/Paper/Folia plugins folder.
2. Start the server once.
3. Review plugins/PAL/security.yml, storage.yml, premium.yml, commands.yml and messages.yml.
4. Keep storage.type: SQLITE for small single-server installs.
5. Test /register <password> <password> and /login <password>.

Network setup

1. Install PAL on the Bukkit auth/lobby server.
2. Install PAL Proxy on Velocity or BungeeCord.
3. Use remote SQL for accounts and sessions.
4. Use Redis for the recommended signed session bridge, or DATABASE mode when Redis is not available.
5. Set the same bridge.sec.secret on Bukkit and proxy.
6. Firewall backend servers and use proxy forwarding secrets.

Important security notes

PAL does not treat a Mojang name lookup as proof of premium ownership. Premium auto-login is trusted only when the connection is verified by Bukkit online-mode, FastLogin, or PAL Proxy.

For production networks, use MySQL/MariaDB/PostgreSQL and Redis where possible. SQLite is intended for single-server setups or controlled tests, not multi-backend production networks.

PAL's backend guard is not a firewall replacement. Always protect backend servers with proper network rules and proxy forwarding configuration.

Support

If you need help, include your server software/version, PAL version, storage type, bridge mode, proxy software, installed integrations and relevant logs. Do not use review sections for support; use the configured support channel first.