OTPplease

# OTPplease Players generate short alphanumeric IDs unique to them. Players with the permission node can look up whom an ID belongs to and whether it has been checked before. Useful for verify flows, ticketing, where you can not have a direct hook/interface into another system where you need to verify players identity. IDs are derived from `HMAC-SHA256(server_secret, uuid:slot)` truncated to base62. The algorithm is public but the secret is not, so players cannot predict or forge IDs even with access to this source code. The secret is generated on first run and stored in `config.yml` — keep it private. --- ## Commands | Command | Description | |---|---| | `/id generate` | Generate a new ID (also works as bare `/id`) | | `/id list` | List all your IDs with verified status. IDs are clickable to copy. | | `/id flush ` | Remove one of your IDs. Only works on IDs that have been verified. | | `/id reset` | Remove all your IDs. | | `/checkid ` | Look up who an ID belongs to. Marks the ID as verified on first use. | --- ## Permissions | Node | Default | Description | |---|---|---| | `otpplease.id.generate` | everyone | Generate a new ID | | `otpplease.id.list` | everyone | List your IDs | | `otpplease.id.flush` | everyone | Remove a verified ID | | `otpplease.id.reset` | everyone | Remove all your IDs | | `otpplease.checkid` | op | Look up an ID | --- ## config.yml ```yaml # Characters per ID. Minimum 4 recommended. id-length: 6 # How many IDs one player can hold at once. max-ids-per-player: 32 # Rate-limit groups for /checkid. # Players with no matching permission are unlimited. Console is always unlimited. # If a player matches multiple groups, the most permissive (highest rate) wins. checkid-cooldowns: - permission: otpplease.checkid.cooldown.standard limit: 10 window-seconds: 60 # 10 checks per minute - permission: otpplease.checkid.cooldown.strict limit: 5 window-seconds: 3600 # 5 checks per hour # Auto-generated on first run. Do not share or change unless you want to invalidate # the generation algorithm (existing IDs in ids.yml still resolve via /checkid). secret: "" ``` --- ## Data `plugins/OTPplease/ids.yml` stores all IDs. Each entry holds the owning player's UUID, their last known name, and whether the ID has been verified. The file is rewritten on every change; do not edit it while the server is running. Rate-limit state is in memory only and resets on restart.