TgAuth

TgAuth

FOR TESTING PURPOSES ONLY; DO NOT INSTALL ON PRODUCTION SERVERS WHILE BETA TESTING

Telegram-based login for Paper/Purpur servers. Players authenticate through a Telegram bot instead of a password — a code in chat for first-time linking, and inline Confirm/Reject buttons for every login after that. Optional FastLogin integration adds real Mojang-verified premium detection, with a safe fallback when it's not installed.

Features

• No password login — players link their Minecraft account to Telegram once, then confirm logins with a button tap.
• Unauthenticated players can't move, chat, break/place blocks, open inventory, or attack/be attacked. Every relevant Bukkit event is covered, including edge cases like melee damage, buckets, and vehicles.
• Optional FastLogin integration: licensed players skip the confirm step entirely once linked; cracked/offline accounts always confirm through Telegram. Works standalone without FastLogin.
• Cracked ⇄ premium account migration (inventory, advancements, stats, OP)
• Rate-limited link codes, parameterized SQL, no plaintext secrets in logs.
• Fully translatable (lang/*.yml), config and language files auto-update on plugin updates.

Requirements

• Java 21+
• A Telegram bot token from @BotFather
• FastLogin (optional, for hybrid premium+cracked servers)

Setup

1. Drop TgAuth.jar into plugins/, start the server once to generate config.yml.
2. Set telegram.bot-token and telegram.bot-username in plugins/TgAuth/config.yml.
3. /tgauth reload or restart.

Player flow: join → get a code in chat → send /link <code> to the bot → done. On future logins, either instant (licensed + FastLogin confirmed) or a Confirm/Reject button in Telegram.

Commands
/tgcode — Show your current link code
/tgauth reload — Reload config and language files (Permission: tgauth.admin)
/tgauth unlink <player> — Unlink a player from Telegram (Permission: tgauth.admin)
/tgauth forcelink <player> <telegramId> — Force-link an account (Permission: tgauth.admin)
/tgauth userinfo <player> — Link status, Telegram ID, @Username, premium status (Permission: tgauth.admin)
/tgauth fastlogin — FastLogin integration diagnostics (Permission: tgauth.admin)

Permissions

• tgauth.admin (Default: op) — Admin commands
• tgauth.bypass (Default: false) — Skips authorization entirely

Third-party components

Bundled (shaded) into the release jar:

• TelegramBots — MIT License — © Ruben Bermudez
• SQLite JDBC — Apache License 2.0 — © Xerial Project
• Gson — Apache License 2.0 — © Google
• OkHttp — Apache License 2.0 — © Square, Inc.

License

See LICENSE.

Older versions
For older versions go to GitHub.