Admin panel

WorldAPI serves a panel at /admin, next to the API. It shows the load live, streams the console with a command line, follows and writes to chat, and lets you look through worlds, players, files, and plugins, and manage tokens, accounts, groups, and the audit log. Each account sees only what its groups allow.

Where to open it

• Through an SSH tunnel: ssh -L 8110:localhost:8110 you@your-server, then http://localhost:8110/admin/.
• Behind a proxy: https://<your-domain>/worldapi/admin/. Reverse proxy sets that up.

Set panel.publicUrl in config.yml to that outside address, like https://mc.example.com/worldapi. /worldapi admin then sends a link that opens the panel with the code filled in.

Your first account

1. In game, run /worldapi admin. The code works for 30 minutes.
2. Open the panel, choose “I have a code”, and enter it with a password of at least 10 characters.
3. The account takes your player name. The first account joins owner, later ones admin, or the group you name: /worldapi admin moderator.

The console can't run /worldapi admin: a code goes to a player, who then owns the account.

Invite someone

An owner or admin invites people from the Accounts page. The invite is a code the person enters with a name and a password.

A forgotten password

• Run /worldapi admin again: the code sets a new password for your account.
• Or ask another admin: the Accounts page makes a reset code for any account.

Item icons

The panel shows items with the game's own icons. The game's textures can't ship in the jar, so WorldAPI downloads the client for the server's version from Mojang once, about 30 MB, into plugins/WorldAPI/cache. panel.icons: false turns that off.

How it keeps you safe

Passwords are stored as salted PBKDF2 hashes, and sessions as SHA-256 digests of the cookie. The cookie is HttpOnly and SameSite=Strict, the panel's writes carry a header no other site can send, sign-in attempts are rate-limited, and the panel loads nothing from other sites.

Next: Configuration.