PAL - Player Advanced Login
Password, premium and Bedrock authentication for Bukkit, Paper and Folia. One jar for a single server, plus an optional proxy addon for Velocity and BungeeCord networks.
!1
!2+3
!4+5
!6+7
!8+9
!10+11
!12+13
!17
Text Description
PAL — Player Advanced Login
PAL is a free, open-source authentication plugin for Bukkit-compatible Minecraft servers. It covers account registration, password login, premium identity handling, Bedrock identity support, sessions, pre-auth restrictions, migrations, placeholders, LuckPerms contexts and optional proxy session bridging.
Beta notice: PAL
0.1.0is intended for staging and controlled beta networks. Test it with your exact server stack and keep database/config backups before using it on a public production network.
What PAL does
PAL protects your server before authentication is complete. Players without a verified premium identity register and log in with a password, premium players are trusted only when ownership is actually verified, and Bedrock players are detected through Floodgate/Geyser.
It is designed for both small single-server setups and larger proxy networks. On a single server, PAL can run with SQLite. On a network, PAL can sync signed sessions through Redis or a shared SQL database with the optional PAL Proxy addon.
PAL is an authentication and account-security plugin. It does not provide, promote or endorse pirated copies of Minecraft, and it does not bypass any Mojang or Microsoft ownership check.
Main features
- Password account registration and login.
- Premium auto-login through verified sources only: Bukkit online-mode, FastLogin, or PAL Proxy login-phase verification.
- Bedrock identity handling through Floodgate/Geyser.
- Hybrid premium and password account behavior for offline-mode networks.
- PBKDF2-SHA256 password hashing with automatic rehash on login.
- Configurable password policy: length limits, username blocking, common-password blocking and repeated registration confirmation.
- Persistent auth sessions with optional IP and username binding.
- TOTP two-factor authentication with backup recovery codes.
- Pre-auth restrictions for movement, chat, commands, inventory, drops, pickups, damage, block actions and teleports.
- Logical AUTH, LOBBY and LIMBO realms with separate restrictions, spawn points and effects.
- SQLite, MySQL, MariaDB and PostgreSQL storage.
- Redis or shared SQL bridge for network sessions.
- Importers for AuthMe, nLogin, OpeNLogin, LibreLogin, LoginSecurity and FastLogin.
- PlaceholderAPI expansion.
- LuckPerms runtime contexts.
- Bukkit API events for account and session lifecycle changes.
- Fully configurable commands, aliases, permissions and messages.
Supported integrations
- FastLogin — verified premium login decisions.
- Floodgate/Geyser — Bedrock identity detection.
- PlaceholderAPI —
%pal_*%placeholders. - LuckPerms — auth/session/storage runtime contexts.
- PAL Proxy — Velocity/BungeeCord network guarding and session handoff.
Player commands
| Command | Alias | Permission |
|---|---|---|
/login <password> | /l | pal.command.login |
/register <password> <password> | /reg | pal.command.register |
/changepassword <old-password> <new-password> | /changepw, /cpw | pal.command.changepassword |
/logout | none | pal.command.logout |
/unregister confirm | none | pal.command.unregister |
/premium confirm | none | pal.command.premium |
/offline confirm | none | pal.command.offline |
/pal2fa <code/setup/confirm/disable/recover> | /2fa | pal.command.2fa |
Admin commands
The admin root command is /pal, with /palauth as an alias.
/pal info/pal reload/pal help/pal account <player>/pal session <player>/pal session clear <player>/pal force-login <player>/pal force-logout <player>/pal reset-password <player> <password>/pal unregister <player>/pal migrate <provider>/pal migrate all
Admin permissions are split by action, including pal.admin, pal.admin.reload, pal.admin.session, pal.admin.force-login, pal.admin.force-logout, pal.admin.reset-password, pal.admin.unregister and pal.admin.migrate.
Placeholders and contexts
PAL includes PlaceholderAPI values such as authentication state, session source, session expiry, 2FA state, bridge mode, storage type, FastLogin availability and Floodgate availability.
When LuckPerms is installed, PAL can expose contexts such as:
pal:authenticatedpal:session_sourcepal:2fa_pendingpal:bridge_modepal:storage_type
Installation
Single server
- Put
PAL-<version>.jarin your Bukkit/Paper/Foliapluginsfolder. - Start the server once.
- Review
plugins/PAL/security.yml,storage.yml,premium.yml,commands.ymlandmessages.yml. - Keep
storage.type: SQLITEfor small single-server installs. - Test
/register <password> <password>and/login <password>.
Network setup
- Install PAL on the Bukkit auth/lobby server.
- Install PAL Proxy on Velocity or BungeeCord.
- Use remote SQL for accounts and sessions.
- Use Redis for the recommended signed session bridge, or DATABASE mode when Redis is not available.
- Set the same
bridge.sec.secreton Bukkit and proxy. - Firewall backend servers and use proxy forwarding secrets.
Important security notes
PAL does not treat a Mojang name lookup as proof of premium ownership. Premium auto-login is trusted only when the connection is verified by Bukkit online-mode, FastLogin, or PAL Proxy.
For production networks, use MySQL/MariaDB/PostgreSQL and Redis where possible. SQLite is intended for single-server setups or controlled tests, not multi-backend production networks.
PAL's backend guard is not a firewall replacement. Always protect backend servers with proper network rules and proxy forwarding configuration.
Support
If you need help, include your server software/version, PAL version, storage type, bridge mode, proxy software, installed integrations and relevant logs. Do not use review sections for support; use the configured support channel first.
Сервер для плагина PAL - Player Advanced Login - как у профи
Плагин PAL - Player Advanced Login создан для серверов: на своём сервере вы настраиваете его под себя и решаете, кому играть. Создать сервер с плагином PAL - Player Advanced Login для друзей можно за пару минут - BungeeHost всё уже подготовил.