Permissions#
| Node | Default | Grants |
|---|---|---|
slimelogin.register |
everyone | /register |
slimelogin.login |
everyone | /login |
slimelogin.logout |
everyone | /logout |
slimelogin.changepassword |
everyone | /changepassword |
slimelogin.unregister |
everyone | /unregister |
slimelogin.premium |
everyone | /premium |
slimelogin.admin |
operators | /slimeadmin and everything under it |
slimelogin.bypass |
nobody | Skips the login gate — conditions below |
slimelogin.bypass#
The permission alone is not enough. The account must also be genuinely verified — by Mojang for a Java player, or by Xbox Live for a Bedrock player coming through Floodgate.
| Player | Has the permission | Verified | Bypasses |
|---|---|---|---|
| Real owner, official launcher | yes | yes | ✓ |
| Bedrock player via Geyser + Floodgate | yes | yes | ✓ |
| Cracked client using the same name | yes | no | ✗ |
| Anyone else | no | — | ✗ |
This is deliberate. A bypass that trusted a username would let anyone through by typing a staff member's name into a cracked launcher.
The same rule applies to sessions and trusted IPs: an admin who is not verified never inherits either and must type the password every time.
On a proxy#
Proxies have no permission defaults
Bukkit reads defaults from plugin.yml. Neither Velocity nor BungeeCord has that concept, so
every permission is denied unless a permissions plugin grants it.
Grant slimelogin.admin explicitly, for example with LuckPerms:
/lp user BeboNaiem permission set slimelogin.admin true
/lp group admin permission set slimelogin.admin true
The player commands are not permission-checked on a proxy — a player who cannot run /register
could never join at all, which would be a strange thing to configure. slimelogin.admin and
slimelogin.bypass are the two nodes that matter there.
On BungeeCord the console always counts as an administrator, so /slimeadmin works from it without
any permissions plugin at all.
Bridge servers#
A bridge server has no commands of its own, so it needs no permissions.
slimelogin.bypass is not honoured there either: the proxy decides who is authenticated, and the
bridge only enforces that answer.