Accounts Login

Accounts Login

KOKOTO WebChat 5.0.0 · Minecraft 1.18–26.2 · Java 17 baseline

10. Account Linking and Login

10.1 Link a Minecraft Account

Generate a link code in the web UI, then run in-game:

/kchat auth <code>

Permission:

kwc.auth

Related settings:

auth:
  enabled: true
  link-code-length: 6
  link-code-expire-seconds: 180
  link-code-cooldown-seconds: 3
  link-code-max-per-minute: 10

10.2 Password Login

Set a web password in-game:

/kchat password <newPassword>

auth:
  password-login: true
  remember-session-days: 30

Passwords are stored as hashes, but HTTP login traffic is not encrypted. Use HTTPS for public deployments.

10.3 Roles

Available roles:

• USER
• MODERATOR
• ADMIN
• Unauthenticated guest access

Permission-based automatic administrator role:

auth:
  auto-admin-from-permission: true
  admin-permission: "kwc.admin"

10.4 Local Administrator Accounts

Local web administrator accounts can exist without a linked Minecraft UUID.

admin:
  allow-local-admin-accounts: true

Commands:

/kchat admin create <id>
/kchat admin password <id> <password>
/kchat admin role <id> <user|moderator|admin>

10.5 Session Management

/kchat sessions
/kchat revoke <username>

revoke removes active sessions and notifies connected browser clients that authentication expired.

11. Login and Connection Security

security:
  login-fail-limit: 5
  login-fail-window-seconds: 300
  login-lock-seconds: 600
  max-sse-connections-per-ip: 5
  max-sse-connections-total: 200

These settings provide temporary login lockout and per-IP/total SSE connection limits. A value of 0 disables the corresponding limit.

Optional administrator login IP restriction:

admin:
  allow-admin-login-from: []

An empty list allows all addresses. Public administrator accounts should use HTTPS and strong passwords.

Changing existing session lifetime

auth.remember-session-days applies to USER/MODERATOR sessions and admin.admin-session-expire-hours applies independently to ADMIN sessions. Changing either setting through Web Admin Settings, /kchat settings, or config.yml followed by startup/reload recalculates existing affected sessions from their original creation time. 0 means unlimited for both USER/MODERATOR and ADMIN session lifetime settings. Already-expired sessions are never resurrected; sessions older than a newly shortened lifetime expire immediately.