AuthMe setup
Set up login and registration for your server and get ready-made lines for config.yml with an explanation for each.
Presets
What to change in config.yml: 0
Everything matches the default config for now. Pick a preset or change the settings below, and the lines to paste will appear here.
Basics
Message language and account mode
settings.messagesLanguageThe language AuthMe uses to tell players “register” and “enter your password”. English by default; for a Russian server set ru.
settings.perPlayerLocaleEach player gets messages in their game language, and the language above is used as a fallback.
settings.serverNameInserted into the plugin's messages and emails.
settings.enablePremiumPlayers with an official Minecraft account join without entering a password, everyone else as usual. The plugin picks the verification method itself.
settings.preventOtherCaseIf Xephi is registered, XEPHI and xephi won't be able to log in. Protects against impersonation using different letter case.
Registration
How a player creates an account for the first time
settings.registration.enabledTurn it off and new players won't be able to create an account.
settings.registration.forceWithout registering and logging in a player can't do anything. Exceptions are set in the restrictions section below.
settings.registration.typePASSWORD: the player picks their own password. EMAIL: a password is generated and sent to the email address they provided.
settings.registration.secondArgNONE: the password is entered once. CONFIRMATION: it must be repeated as the second word. EMAIL_OPTIONAL and EMAIL_MANDATORY: the second argument is an email, optional or required.
settings.registration.messageIntervalHow often the plugin repeats the “log in or register” message to the player.
settings.restrictions.maxRegPerIpHow many times you can register from one address. 0 means no limit. One is harsh on people who play together from the same home.
settings.restrictions.registerTimeoutHow many seconds a player has to register. 0 means never kick.
settings.registration.forceLoginAfterRegisterAfter registering successfully the player must log in again with the command.
settings.registration.forceKickAfterRegisterThe player is kicked right after registering so they rejoin. Don't enable together with the /login requirement above.
Sign in
What happens when a player enters the password
settings.restrictions.loginTimeoutHow many seconds a player has to enter the password. 0 means never kick.
settings.restrictions.kickOnWrongPasswordThe player is kicked from the server right after a mistake. Helps against brute forcing but annoys regular players.
settings.restrictions.kickNonRegisteredA player without an account is kicked right on join. This is private server mode.
settings.restrictions.ForceSingleSessionAn online player can't be kicked by someone joining with the same nickname (“Logged in from another Location”). Closes a well-known session hijacking hole.
settings.restrictions.maxLoginPerIpHow many players can be logged in from one address. 0 means no limit.
settings.restrictions.maxJoinPerIpHow many connections are allowed from one address. 0 means no limit.
Sessions
So you don't enter the password after every disconnect
settings.sessions.enabledThe plugin remembers the nickname and IP. If the player reconnects from the same address before it expires, no password is asked.
settings.sessions.timeoutAfter how many minutes the password is asked again. The session also ends when the IP changes.
Before login
What a player may do before entering the password
settings.restrictions.allowChatOff means the guest can't chat. All commands except those listed below are blocked too.
settings.restrictions.hideChatA player who hasn't logged in can't see other players' chat.
settings.restrictions.allowCommandsEverything else is blocked. Removing /login or /register from here locks everyone out.
settings.restrictions.allowMovementThe guest can move. The radius is set below.
settings.restrictions.allowedMovementRadiusHow far a guest can walk from the join point. 0 means no limit.
settings.restrictions.teleportUnAuthedToSpawnBefore logging in the player stays at spawn, and after logging in returns to where they left. This way nobody can peek at someone's base from their view.
settings.restrictions.ProtectInventoryBeforeLogInThe guest can't see their inventory contents until they log in. Requires PacketEvents.
Works only with PacketEvents installed, according to the plugin's documentation.
settings.restrictions.DenyTabCompleteBeforeLoginThe guest can't peek at nicknames and commands through autocomplete. Requires PacketEvents.
settings.applyBlindEffectUntil the player logs in, the screen is darkened with the Blindness effect.
settings.restrictions.noTeleportAuthMe never moves players at all. Needed if another plugin handles teleports and they conflict.
Password
Length, banned passwords and storage method
settings.security.minPasswordLengthShorter passwords won't be accepted.
settings.security.passwordMaxLengthThe upper limit on password length.
settings.security.passwordHashThe hashing algorithm. BCRYPT and ARGON2 are deliberately slow, which is good: brute forcing becomes expensive. The other values in the list are needed when the password database comes from a forum engine.
Changing the algorithm on a live server? Add the old one to settings.security.legacyHashes, otherwise people won't be able to log in with their passwords.
settings.security.unsafePasswordsThese can't be used as passwords. Write them in lowercase. Be sure to keep help: the docs warn about a conflict with the command.
settings.restrictions.allowedPasswordCharactersA regular expression. The default [!-~] means all visible ASCII characters, which is what the authors recommend.
Usernames
Which names are allowed on the server at all
settings.restrictions.minNicknameLengthShorter nicknames won't be let in.
settings.restrictions.maxNicknameLengthThe standard Minecraft limit is 16.
settings.restrictions.allowedNicknameCharactersA regular expression. The default is Latin letters, digits and underscore, the same as the game itself allows.
Bots and brute force
Protection against mass joins and password guessing
Protection.enableAntiBotThe plugin turns on protection by itself when too many players join in a short time.
Protection.antiBotSensibilityHow many joins per interval count as an attack.
Protection.antiBotIntervalThe time window over which joins are counted.
Protection.antiBotDurationHow many minutes the protection stays on after it triggers.
Protection.quickCommands.denyCommandsBeforeMillisecondsIf a command arrives sooner than this after joining, it's a bot and the player gets kicked.
Security.captcha.useCaptchaAfter several wrong attempts the player is shown a code to enter.
Security.captcha.maxLoginTryHow many mistakes are allowed before a code is requested.
Security.captcha.captchaLengthHow many characters the code has.
Security.tempban.enableTempbanThe address gets blocked if a wrong password is entered from it too many times.
Security.tempban.maxLoginTriesHow many mistakes the plugin tolerates before banning the address.
Security.tempban.tempbanLengthHow many minutes the temporary address ban lasts.
Protection.enableProtectionLogin and registration are allowed only from addresses in the country list below. Requires a GeoIP database.
Protection.countriesTwo-letter country codes. LOCALHOST is for logging in from the server machine itself.
FAQ
Where do I paste these lines?
Into the plugins/AuthMe/config.yml file on the server. The builder outputs only the changed keys, keeping their nesting: find the same path in your file and set the value. There's no need to replace the whole file, since it has settings that aren't here. After editing, restart the server or run /authme reload.
How do I change the plugin's message language?
Set settings.messagesLanguage to the language code you need, for example ru. The default is en, so a freshly installed AuthMe talks to players in English. There's also settings.perPlayerLocale: when it's on, each player gets messages in their game language, and the value above is used as a fallback.
Players complain they have to enter their password after every disconnect
Enable sessions: set settings.sessions.enabled to true and set settings.sessions.timeout, for example to 30 minutes. The plugin remembers the nickname and IP, and won't ask for the password from the same address during that time. The session ends if the IP changes, and that can't be configured.
What do I do if the server is under a bot attack?
The plugin has a built-in antibot: Protection.enableAntiBot is on by default, and Protection.antiBotSensibility sets how many joins per interval count as an attack. A captcha after several wrong passwords and a temporary address ban for brute forcing also help. The “Under a bot attack” preset above turns all of this on at once.
Be careful with the country filter
Protection.enableProtection restricts joining to a list of countries, but by default that list contains US, GB and LOCALHOST. If you enable the protection without editing the list, players from every other country will stop being able to join. Country codes are two-letter ISO 3166 codes.
Can licensed players join without a password?
Yes, that's what settings.enablePremium does. Players with an official Minecraft account are verified automatically and don't enter a password, everyone else joins as usual. The plugin picks the verification method automatically.
Which password storage method should I choose?
The default is SHA256. BCRYPT and ARGON2 are deliberately slow to compute, and that's the point: brute forcing becomes expensive. Important: if you change the algorithm on a live server, add the old one to settings.security.legacyHashes, otherwise people won't be able to log in with their passwords.
A guest can see other people's builds before logging in
Enable settings.restrictions.teleportUnAuthedToSpawn: before logging in the player stays at spawn, and after logging in returns to where they left. This is usually paired with hiding chat and blocking movement.
Where the data comes from
Setting names and default values were taken from the plugin's official documentation on September 1, 2026. The builder has the settings people actually change by hand; the plugin creates the rest itself.