ProudAuth

ProudAuth - Modern Authentication System for Velocity Networks

ProudAuth is an advanced authentication system designed for modern Minecraft networks using Spigot/Paper backend servers together with a Velocity-based proxy setup.

It provides secure login, registration, premium account handling, cracked account support, network authentication synchronization, backend protection, 2FA, admin tools, monitoring tools, and the ProudAccess delegated account access system.

Important: ProudAuth is not intended to be used as a simple standalone Spigot plugin. It is designed for network environments where backend servers are protected behind a proxy.

Main Features

• Complete authentication system for cracked/SP accounts, including login, registration, logout, password change, and session handling.
• Premium account support with Mojang profile verification, premium UUID resolution, automatic login, and configurable premium nickname policies.
• Mixed premium/cracked network support with claim modes such as strict premium handling, first-join claim, proxy custom claim flow, and automatic first-join claim.
• Premium/cracked claim commands allowing players to choose whether a nickname should be handled as premium or cracked, depending on your configured policy.
• Session restore system with configurable session lifetime and optional IP binding.
• 2FA/TOTP support with authenticator app setup, setup confirmation, disable flow, status check, and optional always-required 2FA behavior.
• Suspicious access detection for 2FA based on IP/account patterns, such as too many usernames from one IP or too many IPs for one username.
• Brute-force protection with configurable maximum failed attempts and temporary lockout duration.
• Proxy-side anti-abuse guards including anti-bot connection limits, identity correlation checks, temporary IP bans, and configurable history retention.
• IP ban system with backend and proxy support, including manual bans, unbans, active ban checks, and banwave tools.
• Trusted IP system for account/IP trust management.
• Premium IP whitelist system for restricting selected premium accounts to specific allowed IPs.
• Auth server flow with optional forced auth-entry backend, authentication timeout, and configurable post-auth redirect server.
• Protected auth-entry mode to prevent unauthorized manual transfers into the auth server after players are already inside the network.
• Direct post-auth routing for verified premium users when configured, allowing premium players to skip the auth backend after proxy verification.
• Backend protection while unauthenticated including movement, chat, command, interaction, block, inventory, PvP, item pickup, food, consume, drop, book edit, and world interaction restrictions.
• Visibility protection to hide unauthenticated players from others and optionally hide other players from unauthenticated users.
• Auth spawn handling with optional world spawn or custom auth location teleport.
• Visual protection effects during authentication, with configurable effect behavior.
• No-drop-on-death protection for unauthenticated players.
• Trusted proxy-to-backend bridge using signed assertions, shared secret validation, assertion TTL, and optional strict backend enforcement.
• Backend readiness probe before completing proxy-to-backend transfers, reducing broken joins when an auth backend is not ready.
• Network-wide configuration sync where Velocity publishes the authoritative config to MySQL and backend servers automatically pull updates.
• Language system with configurable messages for backend and proxy flows, including ProudAccess hover/click text.
• Detailed debug channels for session flow, premium flow, bridge flow, protection flow, IP ban flow, profile flow, command flow, movement audit, and teleport audit.
• Security and risk reports with IP history, user risk inspection, top-risk reports, and CSV export support.
• Automatic security report export with configurable interval, time window, and row limit.
• Admin tools for force login/logout, password reset, player wipe, IP bans, trusted IPs, whitelist IPs, claims, sessions, premium checks, auth info, 2FA reset, unlocks, history, bridge status, debug toggles, statistics, and reload.
• ProudMonitor support for live proxy monitoring sessions and remote staff actions such as message, re-auth request, force logout, kick, and server move.
• ProudAccess delegated account access allowing account owners to authorize trusted players to temporarily access their account.
• ProudAccess fingerprint and code flow with click-to-copy support, code verification, active access listing, revoke support, and history pages.
• ProudAccess premium and cracked target support when used with the required ProudX proxy fork.
• Dynamic command tab completion for ProudAccess, including join suggestions based only on accounts the player is actually authorized to access.
• MySQL-backed storage for accounts, sessions, IP bans, IP history, identity claims, trusted IPs, premium whitelist IPs, proxy assertions, backend probes, delegated access grants, delegated access history, and network config snapshots.

ProudAccess Module

ProudAccess allows an account owner to authorize another player to temporarily access their account through a secure delegated access flow.

The system uses fingerprint verification, confirmation codes, backend validation, proxy-side profile handling, and automatic restoration when leaving the delegated account.

• Authorize another player with /proudaccess allowAccess.
• Join an authorized account with /proudaccess accessJoin.
• Confirm access using a secure generated code.
• Leave the delegated account with /proudaccess accessLeave.
• Revoke active delegated access.
• View active AllowAccess entries.
• Click-to-copy support for fingerprints and codes.
• Dynamic tab completion based on accounts the player can actually join.
• Support for premium and cracked target accounts.

Backend Player Commands - Spigot/Paper

• /login <password> - Log into a cracked/SP account.
• /register <password> <confirm> - Register a cracked/SP account.
• /sp - Claim the current nickname as cracked/SP.
• /cracked - Alias for /sp.
• /premium - Start the premium claim flow for the current nickname.
• /changepassword <old> <new> <confirm> - Change the account password.
• /logout - End the current authentication session.
• /2fa <code> - Submit a 2FA code when required.
• /2fa init - Start 2FA setup.
• /2fa setup <code> - Confirm 2FA setup.
• /2fa disable <code> - Disable 2FA.
• /2fa flow <true|false> - Configure whether 2FA is always required.
• /2fa status - View current 2FA flow status.
• /2fa code <code> - Submit a 2FA code using the explicit subcommand.

Backend Admin Commands - Spigot/Paper

• /proudauth forcelogin <player> - Force-authenticate a player.
• /proudauth forcelogout <player> - Force-end a player session.
• /proudauth resetpassword <player> <new> - Reset a player password.
• /proudauth wipeplayer <player> - Completely wipe a player account.
• /proudauth banip <ip> [seconds] - Temporarily ban an IP.
• /proudauth unbanip <ip> - Remove an IP ban.
• /proudauth trustip <ip> <player> - Add a trusted IP for a player.
• /proudauth trustip clear <player> - Clear trusted IP data for a player.
• /proudauth whitelistip add <player> <ip> - Add a premium whitelist IP.
• /proudauth whitelistip remove <player> <ip> - Remove a premium whitelist IP.
• /proudauth whitelistip list <player> - List premium whitelist IPs.
• /proudauth whitelistip clear <player> - Clear premium whitelist IPs.
• /proudauth claim status <player> - View claim status.
• /proudauth claim set <player> <premium|cracked> - Force-set account type claim.
• /proudauth claim clear <player> - Clear claim state.
• /proudauth claim pending clear <player> - Clear pending claim state.
• /proudauth session list <player> - List sessions for a player.
• /proudauth session clear <player> - Clear sessions for a player.
• /proudauth session clearip <ip> - Clear sessions by IP.
• /proudauth premiumcheck <player> - Run a premium check.
• /proudauth authinfo <player> - View full auth/account info.
• /proudauth 2fa status <player> - View a player's 2FA status.
• /proudauth 2fa reset <player> - Reset a player's 2FA.
• /proudauth unlock <player> - Clear lockout and pending auth state.
• /proudauth history <player> [limit] - View IP/account history.
• /proudauth bridge status <player> - Inspect proxy/backend bridge state.
• /proudauth debug player <player> - Inspect player debug state.
• /proudauth debug toggle <channel> <on|off> - Toggle debug channels.
• /proudauth stats - View ProudAuth statistics.
• /proudauth reload - Reload ProudAuth backend configuration.
• /proudauthbackend - Alias for /proudauth.

Proxy Commands - Velocity

• /paproxy reload - Reload ProudAuth proxy state.
• /paproxy iphistory <ip> - Inspect IP history.
• /paproxy risk <username> - Inspect user risk data.
• /paproxy risk-top [limit] [hours] - Show top risky users/IPs.
• /paproxy banwave-ip <ip> <seconds> [reason] - Apply a proxy-side IP banwave.
• /paproxy export-risk-csv [hours] [limit] - Export risk data to CSV.
• /paproxy whitelistip add <player> <ip> - Add a premium whitelist IP from proxy.
• /paproxy whitelistip remove <player> <ip> - Remove a premium whitelist IP from proxy.
• /paproxy whitelistip list <player> - List premium whitelist IPs from proxy.

ProudAccess Commands - Velocity

• /proudaccess help - Show ProudAccess help.
• /proudaccess fingerprint - Show your ProudAccess fingerprint.
• /proudaccess allowAccess <player> <fingerprint> - Allow a player to access your account.
• /proudaccess allowAccess list - View active delegated access permissions.
• /proudaccess allowList - Direct alias for the AllowAccess list.
• /proudaccess accessList - Direct alias for the AllowAccess list.
• /proudaccess accessJoin <owner> - Request access to an authorized account.
• /proudaccess code <code> - Confirm a delegated access request.
• /proudaccess accessLeave - Leave a delegated account and restore your own.
• /proudaccess revokeAccess <player> - Revoke delegated access.
• /proudaccess history [page] [player] --filter OUT/IN - View ProudAccess history.
• /paaccess - Alias for /proudaccess.

ProudMonitor Commands - Velocity

• /proudmonitor - Open a monitor session.
• /proudmonitor sessionlist - Show the active monitor session.
• /proudmonitor closesession - Close the active monitor session.
• /proudmonitor stop - Alias for closing the active monitor session.
• /proudmonitor restart - Restart the monitor session.
• /pmonitor - Alias for /proudmonitor.
• /pmon - Alias for /proudmonitor.

Requirements

• A Spigot/Paper backend server.
• A Velocity-based proxy network.
• MySQL storage.
• Backend servers must be protected behind the proxy.
• Correct proxy forwarding configuration.

ProudAccess Requirement

Important: The ProudAccess module requires the modified Velocity fork called ProudX.

Standard Velocity does not correctly support the delegated profile forwarding required by ProudAccess, so this module will not work properly without ProudX.

At the moment, ProudX is not publicly included in the package. It can currently be obtained only by opening a ticket via DM on the official Discord:

https://discord.gg/T2k6Djmscs

Who Is This For?

ProudAuth is recommended for server owners running Velocity-based Minecraft networks who need a complete authentication system with premium/cracked account handling, backend protection, network synchronization, admin tooling, monitoring, and secure delegated account access.

It is especially useful for mixed-mode networks that want stronger control over authentication, account ownership, and trusted access between users.