Slime Login

Single server#

The simplest setup: one Paper server, no proxy. The plugin does everything itself.

Requirements#

Why offline mode?

With online-mode=true Mojang verifies every connection, so cracked players cannot join at all and there is nothing to authenticate. Offline mode lets everyone in — and Slime Login then runs the Mojang handshake only for players whose name belongs to a real premium account. See Premium detection.

What a player sees#

  1. Joins with the official launcher.
  2. Mojang verifies them during the handshake.
  3. They are logged in immediately, with their real UUID and skin.

No command, no password, no registration — on their very first join.

  1. Joins.
  2. Frozen at spawn, title on screen: Type /register <password> <confirm>.
  3. /register mypass mypass
  4. Free to play.
  1. Joins.
  2. If their session or trusted IP is still valid → logged in automatically.
  3. Otherwise: /login mypass.

The settings that matter most#

plugins/slimelogin/config.yml
license-key: "YOUR-KEY"

premium-bypass:
  enabled: true
  mode: auto                    # premium players auto-login on first join
  protect-premium-names: true   # a cracked client cannot take a premium name

security:
  bcrypt-rounds: 12             # raise only if your CPU is fast
  max-login-attempts: 3
  lockout-duration-seconds: 60
  max-accounts-per-ip: 0        # set e.g. 3 to stop mass registration

session:
  enabled: true
  duration-minutes: 60
  trusted-ip: true

title:
  kick-after-seconds: 30        # 0 = never kick

Everything else is documented in the config.yml reference.

Holding players at a login spawn#

By default unauthenticated players are frozen where they land. If you would rather hold them at a fixed spot — a small walled area, a floating platform — use the login spawn:

  1. Stand where you want them held.
  2. /slimeadmin setspawn

  3. Enable it:

    spawn:
  enabled: true
  teleport-back: true   # put them back where they were after logging in

Making an admin exempt#

slimelogin.bypass skips the login gate — but only for an account that is genuinely verified by Mojang. A cracked client joining with your name still has to log in. That is deliberate: a bypass permission that trusts a username would be a way in, not a convenience.

Moving to a proxy later#

Nothing is lost. Copy plugins/slimelogin/players.db to the proxy's plugins/slimelogin/ folder, put the jar on the proxy, and the same accounts and passwords keep working — the schema is identical. See Proxy network.