FoliaLogin

FoliaLogin is an AuthMe-style authentication plugin built specifically for Folia (also runs on Paper), for Minecraft 1.20+. It provides secure account registration and login, optional two-factor authentication (2FA), and prevents players from interacting with the server until they are authenticated.

---

Highlights

• Auth commands: /register, /login, /changepassword, /logout
• Two-factor authentication (TOTP): works with Google Authenticator, Authy, Aegis, 2FAS…
• Passwords and 2FA codes are hidden from the console
• Blocks movement, interactions, inventory, chat, and commands until authenticated
• IP-based sessions (optional)
• Configurable reminders (login/register/2FA prompts)
• BCrypt password hashing (secure storage)
• Anti-bruteforce protection: lockouts survive reconnects, 2FA codes can't be reused
• Max accounts per IP (configurable limit)
• Auth spawn with /authme setspawn (saves your position and the direction you're looking)
• Return to last location after login, or always spawn at the spawn on join
• No-return worlds: players who log out in an event/minigame world rejoin at the spawn
• 100% async, thread-safe database operations
  • SQLite by default
  • MySQL/MariaDB via HikariCP
• 100% Folia-safe (no BukkitScheduler usage)
• Fully configurable: config.yml + lang.yml. New options are added automatically on update, no need to delete your config
• Admin tools: /authme suite + permissions
• Optional premium/proxy mode for auto-login when UUID forwarding is enabled

---

Compatibility

• Server: Folia or Paper, 1.20 – 1.20.6 (1.21 should work)
• Java: 17 or newer (21 recommended)

---

Languages

• English by default, fully translatable via lang.yml

---

Installation

1. Drop the jar into /plugins
2. Restart the server
3. Configure:
   • config.yml
   • lang.yml
4. /authme reload or restart after changes

Updating: just replace the jar and restart. The database and config files are upgraded automatically.

---

Commands

Players

• /register <password> [password] (alias /reg)
• /login <password> (alias /l)
• /changepassword <old> <new> [new] (aliases /changepass, /cp)
• /logout

Two-factor authentication (2FA)

• /2fa add <password>: shows your secret key (click to copy) to add in your authenticator app
• /2fa confirm <code>: enables 2FA
• /2fa <code>: enter your code after /login
• /2fa remove <code>: disables 2FA

Admin

• /authme register <player> <password>
• /authme changepassword <player> <newpass>
• /authme unregister <player>
• /authme reload
• /authme status <player>
• /authme setspawn: sets the login spawn at your position and facing direction
• /authme resettotp <player>: removes a player's 2FA (lost phone)

---

Permissions

Permission	Default
authme.player.register / login / changepassword / logout	everyone
authme.player.totp (set up 2FA)	everyone
authme.admin.register / changepassword / unregister / reload / status	op
authme.admin.setspawn / authme.admin.resettotp	op
authme.bypass (only if security.allowBypassPermission: true)	op

---

Spawn options (config.yml)

spawn:
  useAuthSpawn: true          # teleport players to the spawn until they log in
  useWorldSpawn: true         # true = world spawn, false = location set with /authme setspawn
  spawnWorld: ""              # empty = main world
  returnToLastLocation: true  # after login, go back to where you logged out
  forceSpawnOnJoin: false     # always start at the spawn when joining
  noReturnWorlds: []          # e.g. ["event"]: logging out there = rejoin at the spawn