🛡️ xLogin – Simple, Lightweight & Powerful Authentication

xLogin is an all-in-one authentication system designed for servers that want maximum security without the bloat. Forget about complex external database setups; xLogin is optimized to work locally, fast, and secure out of the box, whether you run a standalone server or a massive Proxy network.

Note: /premium is only available for networks and proxies. Compatible with Bungeecord, Velocity, Waterfall, and others. How do I activate proxy mode? Go to config.yml and enable proxy mode, then download and install the add-on for your proxy, and you're all set!

---

🚀 Key Features

• 🌐 Smart Network & Proxy Ready: Fully compatible with BungeeCord and Velocity. Features auto-detection to enable secure UUID verification and includes an automatic Auth-Lobby redirect system to send players to a specific server upon successful login.
• 📦 Local-First Storage & Backups: High-performance, thread-safe H2 database system (data.mv.db). No need for MySQL to get professional network-level performance. Easily create instant database backups via in-game commands!
• 💎 Smart Premium System: Using an official Minecraft account? Players can use /premium to enable auto-login. The plugin uses real Mojang validation (via your Proxy) to ensure nobody can steal a premium identity.
• 🧠 Industrial-Grade Security:
  • BCrypt Hashing: Passwords are encrypted with the industry standard, making them virtually impossible to crack.
  • Premium Name Impersonation Protection: Automatically kicks non-premium players trying to join with the username of an official purchased account.
  • Anti-Bot Captcha: A visual verification system during registration to stop bot attacks in their tracks.
  • Total Protection: Blindness, immobilization, and block/damage protection until the user is authenticated.
  • Asynchronous Logging: Keeps a silent, detailed history of logins, registrations, and admin actions.
• 🖼️ Ultimate Admin Control: Manage everything from the console or in-game. Features an intuitive visual GUI menu with player heads, plus a massive arsenal of commands to purge inactive users, force logins, change UUIDs, and more.
• 📱 Bedrock Support (Geyser): Fully compatible with console and mobile players via Floodgate integration. Bedrock players authenticated via Xbox Live can automatically bypass the login screen (100% configurable).
• ⚡ Performance Optimized: Fully asynchronous database operations ensure your TPS stays at 20.0, no matter how many players are joining.

---

🛠️ Commands & Permissions

Player Commands

Command	Description	Permission
/login <pass>	Log in to your account.	None
/register <pass> <pass>	Create a new account with captcha.	None
/premium [confirm]	Toggle Auto-login (Premium Mode).	None
/changepassword <old> <new>	Securely change your current password.	None
/captcha <code>	Solve the registration captcha.	None

Admin Commands (xlogin.admin)

Command	Description
/xlogin gui	Open the visual administration menu.
/xlogin backup	Create an instant backup of the database.
/xlogin purge <days>	Delete all accounts inactive for <days>.
/xlogin verify <user>	View a player's UUID, IP, Premium status, & last login.
/xlogin forcelogin <user>	Forcefully log a player into the server.
/xlogin setspawn / spawn	Set or teleport to the login spawn location.
/xlogin changepass <user> <pass>	Forcefully change a player's password.
/xlogin changeuuid <user> <uuid>	Manually update a player's registered UUID.
/xlogin unpremium <user>	Remove the premium auto-login status from an account.
/xlogin unban <ip>	Remove an IP from the registration blacklist.
/xlogin unregister <user>	Completely delete a player's account.
/xlogin reload	Reload the plugin configuration and messages.

---

⚙️ Simplified Configuration

We've stripped the config down to the essentials so you don't waste time, while giving you absolute control over your network.

config.yml

# -------------------------------------------------------
#           __             _
#   __  __ / /  ___   __ _(_)_ __
#   \ \/ // /  / _ \ / _` | | '_ \   Made by xPlugins
#    >  </ /__| (_) | (_| | | | | |     Fork: Paper
#   /_/\_\____/\___/ \__, |_|_| |_|
#                  |___/ Release v1.0.6
#
#        Wiki: [https://xplugins.es/xlogin](https://xplugins.es/xlogin)
#    24/7 Support: [https://discord.gg/AH5k9YE78b](https://discord.gg/AH5k9YE78b)
# -------------------------------------------------------

settings:
  # The default language (es, en). It will load messages_es.yml or messages_en.yml
  language: "en"

protection:
  # Block everything before logging in (movement, chat, etc.)
  general-protection: true

  # Visual effects upon joining the server
  effects:
    blindness: true

security:
  # Auto-register premium users detected by the proxy (Requires BungeeCord/Velocity)
  auto-premium-registration: false
  # Prevents Non-Premium players from using premium account names (Requires BungeeCord/Velocity)
  prevent-premium-name-impersonation: false

  # Allowed commands BEFORE logging in
  allowed-commands-before-login:
    - "/help"
    - "/rules"
    - "/discord"

passwords:
  size:
    min: 6
    max: 20

#      ___          _                _
#   / __\ ___  __| |_ __ ___   ___| | __
#  /__\/// _ \/ _` | '__/ _ \ / __| |/ /
# / \/  \  __/ (_| | | | (_) | (__|   <
# \_____/\___|\__,_|_|  \___/ \___|_|\_\
geyser-support:
  # If true, Bedrock players (Floodgate) join without needing to login.
  auto-login-bedrock: true

#      __     _                      _
#   /\ \ \___| |___      _____  _ __| | __
#  /  \/ / _ \ __\ \ /\ / / _ \| '__| |/ /
# / /\  /  __/ |_ \ V  V / (_) | |  |   < 
# \_\ \/ \___|\__| \_/\_/ \___/|_|  |_|\_\
proxy-redirect:
  # Send the player to the target server after a successful login (ideal for Auth&Lobby)
  enabled: false
  target-server: "Lobby"

captcha:
  enabled: true
  timeout-seconds: 120

ui:
  titles:
    before-login:
      title: '&#A9DFBFWelcome!'
      subtitle: '&fUse /login <password>'
    before-register:
      title: '&#FAD7A0Register!'
      subtitle: '&fUse /register <password> <password>'
    after-login:
      title: '&#A9DFBFSuccess!'
      subtitle: '&fEnjoy your stay'
    incorrect-password:
      title: '&#F1948AIncorrect Password!'
      subtitle: '&7Please try again'

logging:
  enabled: true
  log-successful-logins: true
  log-registrations: true
  log-failed-attempts: true
  log-admin-actions: true