User Manual v6.3.1

PureAuth v6.3.1

Player and administrator manual · Paper/Purpur · BungeeCord · Velocity

This manual explains how to use PureAuth v6.3.1 on Minecraft 26.2.x and 26.3. It covers installation, configuration of every module, every command, permissions, all settings and messages. Replace examples in <brackets> with your own values. Players enter commands with /; omit / in the console.

Proxy synchronization must be configured in two places: on the proxy AND on every backend. In each appropriate config.yml, set network.sync.enabled: true and the same independently generated secret in network.sync.shared_secret. Exact paths, generation and a complete example are in section 5.

Purpose and changes in v6.3.1
Requirements and files
Installing a single server
Installing a proxy network
Proxy synchronization and the secret — step-by-step setup
Upgrading from v6.3.0 and v6.2.0
Registration, login and passwords
PIN and GUI appearance
2FA and backup codes
Admin Guard
Account recovery
Progressive locks
Sessions and Premium Auto-Login
Ghost Mode and protection before login
Redis and username protection
Fair Play Guard
Administrator commands
Permissions
Database and performance
Messages and notifications
Backups and restoration
Discord, logs, PlaceholderAPI and updates
Reloading and restarting
Troubleshooting
Checking your own server after installation
Complete Paper configuration
Complete BungeeCord and Velocity configuration
Complete message index

1. Purpose and changes in v6.3.1

PureAuth protects accounts on offline-mode servers. The primary proof of identity is a password or an optional PIN. You can add TOTP 2FA, backup codes and a recovery question. The plugin provides CAPTCHA, an account limit per IP, short sessions, Premium Auto-Login, progressive locks, mandatory administrator 2FA, backups and integrations. Fair Play Guard supports inspections conducted by administrators.

The main changes in v6.3.1 are:

safer login synchronization requiring a shared secret; update all network modules together;
short sessions requiring a matching IP and current account security settings;
revocation of previous trust after changes to passwords, PINs, 2FA, recovery or other security details;
persistent recovery-answer failures: every three failures advance the shared account-lock stage;
administrators remain restricted until mandatory 2FA setup has been saved;
improved handling of many login attempts and a shared account limit per IP;
Ghost Mode keeps actual inventory items and improves player hiding;
additional interaction restrictions before authentication and a timeout that also covers 2FA;
new connections remain blocked when security services cannot start safely.

2. Requirements and files

Component	Requirement / purpose
Backend	Paper 26.2.x or 26.3; check compatibility with your specific Purpur build
Server JVM	At least Java 25 and compatibility with the requirements of the specific server/proxy build
BungeeCord	A current official build supporting clients of the target Minecraft version, 26.2.x / 26.3
Velocity	4.2.0 or a newer compatible release for 26.2.x and 26.3 networks; do not use 3.5.1 for 26.3 clients
Backend `server.properties`	`online-mode=false`

Choose the appropriate release file:

File	Where to install
`pureauth-paper-6.3.1.jar`	`plugins/` on every protected backend
`pureauth-bungeecord-6.3.1.jar`	`plugins/` on each BungeeCord proxy
`pureauth-velocity-6.3.1.jar`	`plugins/` on each Velocity proxy

Install one matching module on each proxy. A proxy JAR does not replace the Paper JAR. Bukkit, standalone Spigot, Folia and Fabric/Forge are not supported targets for this release.

3. Installing a single server

Stop the server and back up existing data.
Put the Paper JAR in plugins/. Remove the previous PureAuth JAR from that directory so two versions cannot load together.
Set online-mode=false in server.properties.
Start the server to generate plugins/PureAuth/config.yml and plugins/PureAuth/Messages/.
Stop it, adjust the settings and start it again.
Check the console: the module should start without database, configuration or security errors.
Set waiting locations with /pureauth location login and /pureauth location register while standing at the desired positions.

The following settings are normally sufficient (the language selector can be PL or EN):

database:
  type: "SQLITE"
network:
  mode: "LOCAL"
  sync:
    enabled: false
    shared_secret: ""
settings:
  language: "PL"

This is an excerpt of the existing configuration, not a full replacement. Merge it into the existing sections; do not create a second network, database or settings section. SQLite stores data in plugins/PureAuth/database.db. A standalone server does not need a synchronization secret.

4. Installing a proxy network

Install the matching PureAuth JAR on every public proxy and the Paper JAR on every protected backend.
Create a shared MySQL/MariaDB database. Every module must use the same SQL server, database schema and table prefix. Examples are below and in section 27.
Start the modules once, stop them and edit the generated files.
Configure UUID/IP forwarding appropriate to your proxy and backend platforms. The plugin must receive the real player IP and a consistent UUID throughout the network.
Set backend online-mode=false. Choose account verification settings on the proxy to match your network's account model; the offline-mode requirement here applies to backends.
Firewall backend access so only trusted proxies can connect. The plugin does not replace forwarding protection.
Enable synchronization and configure the secret as described in section 5.
With one proxy you may leave network.mode: LOCAL. With multiple public proxies, set REDIS on all modules and follow section 15.
Restart all modules and check login and backend switching.

SQLite is not a shared network database. Do not copy a live SQLite file between backends or use a network drive as a replacement for MySQL.

SQL example for Paper and BungeeCord:

database:
  type: "MYSQL"
  pool:
    maximum_pool_size: 16
    minimum_idle: 4
    connection_timeout_ms: 10000
    idle_timeout_ms: 600000
    max_lifetime_ms: 1800000
  mysql:
    host: "10.0.0.10"
    port: 3306
    database: "pureauth"
    username: "pureauth_app"
    password: "YOUR_DATABASE_PASSWORD"
    table_prefix: "pureauth_"

The equivalent Velocity configuration uses a different structure:

database:
  driver: "MYSQL"
  pool:
    maximum_pool_size: 16
    minimum_idle: 4
    connection_timeout_ms: 10000
    idle_timeout_ms: 600000
    max_lifetime_ms: 1800000
  host: "10.0.0.10"
  port: "3306"
  database: "pureauth"
  username: "pureauth_app"
  password: "YOUR_DATABASE_PASSWORD"
  prefix: "pureauth_"

Replace example hosts and passwords with your own. The SQL user must be allowed to create and update PureAuth tables and apply database upgrades. The synchronization secret and SQL password are separate settings.

5. Proxy synchronization and the secret — step-by-step setup

5.1 What synchronization provides

After a complete backend login, the proxy remembers authentication for the player's current connection. When the player switches to another protected backend, that backend can accept confirmation so the player does not have to enter their password/PIN/2FA again on every switch within the same proxy session. The destination backend still checks that the account exists, its security settings are current, and account and Fair Play Guard locks permit access. Admin Guard may still require 2FA setup.

Synchronization requires matching secrets and correct system time on the proxy and backends. If settings do not match, log in normally and correct the configuration.

Synchronization and Redis are independent settings. network.mode: REDIS does not enable network.sync.enabled. Synchronization also works with LOCAL, for example one proxy and several backends. Redis does not replace the secret or SQL database.

5.2 Exactly where to enter the secret

Every path is relative to the working directory of that particular instance:

Platform	File to edit
Every Paper/Purpur backend	`plugins/PureAuth/config.yml`
Every BungeeCord proxy	`plugins/PureAuth/config.yml` inside that proxy's directory
Every Velocity proxy	`plugins/pureauth/config.yml` inside that proxy's directory; the plugin ID is `pureauth`

Example: your network has proxy/, lobby/ and survival/. For Velocity, edit proxy/plugins/pureauth/config.yml and lobby/plugins/PureAuth/config.yml and survival/plugins/PureAuth/config.yml. If you have a second proxy, edit its file too. Letter case matters on Linux. If your panel relocates Velocity plugin data, use the plugin directory actually generated by that instance.

Do not enter the secret in game, in a /pureauth command, in Messages, in SQL or in server.properties. Do not edit the JAR. The PureAuth secret is also separate from Velocity's forwarding.secret; configure both independently.

5.3 Generating the secret

Stop the proxy and backends while applying the change. In the administrator's terminal, run this once for the whole network:

openssl rand -hex 32

The result is a random 64-character hexadecimal string. Copy the complete result. If OpenSSL is unavailable, use a trusted local random-secret generator. Do not generate a different value for each server. The minimum accepted length is 32 characters; the recommended result above has 64. Do not use example passwords or a value containing CHANGE_ME, which the plugin rejects.

5.4 What to paste into every config.yml

In the existing network: section, set:

network:
  mode: "LOCAL"
  sync:
    enabled: true
    shared_secret: "CHANGE_ME_GENERATE_WITH_OPENSSL_RAND_HEX_32"

Replace the ENTIRE value between the quotes next to shared_secret with the generator's result. The example marker is deliberately not a working secret. Paste exactly the same value into every instance, without adding spaces, newlines or extra quotation marks inside the value. Keep the indentation: sync belongs under network; enabled and shared_secret belong under sync.

If you use multiple proxies, set mode: "REDIS" and preserve your network.redis section. Do not remove it when copying this excerpt. The secret must match even if your proxies use different platforms.

5.5 Starting and checking the network

Confirm every module is v6.3.1, uses the same account database and has the same secret.
Start SQL and Redis if used, then the backends and proxies.
On a test account without Premium Auto-Login or an active session, log in on backend A. Complete PIN/2FA if required.
Use your normal proxy switching mechanism to move to backend B without disconnecting from the network.
Backend B should finish authentication without another manual login. The synchronization success message is sync_success.
After changing account security settings, check that fresh authentication is required. Disconnecting from the proxy removes trust for the current connection; a new login may still use separate sessions/Premium if enabled.

There is no PureAuth command for displaying or automatically generating the secret. After changing it, fully restart every module. /pureauth reload on a backend does not reload the proxy and is not the procedure for rotating the secret.

5.6 Incorrect secrets or disabled synchronization

The defaults enabled: false and an empty secret mean authentication is not transferred. If the secret is too short or does not match, confirmation is rejected; the player must use normal login, provided the remaining configuration is valid. Missing synchronization never grants access without authentication.

Check the correct file on every instance, YAML indentation, enabled: true, identical secrets, shared database and prefix, UUID/IP forwarding, current JAR versions, system time and the pureauth:sync channel. Do not expose the secret in screenshots or public messages. If it leaks, generate a new value and replace it everywhere during network downtime.

6. Upgrading from v6.3.0 and v6.2.0

Stop proxies and backends.
Keep a complete backup of the database and plugin data directories, configuration and messages.
Replace every module with its v6.3.1 JAR. Do not leave a mixed v6.3.0/v6.3.1 network: the old synchronization protocol is not accepted.
Keep the existing database. Required data upgrades run automatically during startup; do not delete the database or accounts.
Compare your configuration with sections 26–27. Add network.sync and new settings manually; an existing config is not automatically replaced with a complete new template.
Set the secret on a proxy network as described in section 5. Leave synchronization disabled on a standalone server.
Paper adds new missing message keys during startup without replacing custom values. Check proxy files separately; do not assume the same message-upgrade behavior.
Start the modules and perform the checks in section 25.

Passwords/PINs, 2FA and recovery details, Premium flags, lock history and saved locations remain in the database. Old-format trusted sessions are not valid v6.3.1 sessions. Before rolling back, verify a procedure that restores a matching set of JARs, configuration and database backup.

7. Registration, login and passwords

7.1 First registration

When a new player joins, interactions are restricted and instructions appear. CAPTCHA is enabled by default. Read the displayed code and enter:

/register <password> <same_password> <captcha>

If the administrator sets settings.captcha.enabled: false, use exactly two arguments:

/register <password> <same_password>

Passwords must match, contain at least settings.min_password_length characters and fit within 72 UTF-8 bytes. With multibyte characters, 72 bytes can be fewer than 72 characters. Passwords cannot contain spaces because they are command arguments. Registration is subject to settings.max_accounts_per_ip; the limit also applies to instances sharing a database. Use the same limit on every backend. The limit counts stored account IP addresses; people sharing one public IP share that limit.

After successful saving, login completion begins. Accounts covered by Admin Guard must also set up 2FA. Sending a command alone does not confirm a successful save; read any database error message.

7.2 CAPTCHA

settings.captcha.length sets the code length. settings.captcha.characters is the actual alphabet, for example ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789. A-Z0-9 is not range notation: it would be a literal set of a few characters. Length must be 1–32 and the longest possible generated code must fit within 72 UTF-8 bytes; typically choose 5–8. The alphabet must contain 2–256 characters with at least two distinct characters, without whitespace, control characters or characters outside U+0000–U+FFFF. When CAPTCHA is enabled, invalid settings are rejected: startup keeps admission blocked until configuration is corrected, while a failed /pureauth reload preserves the previous working configuration. The console directs you to check CAPTCHA settings without printing file contents. CAPTCHA protects registration; it is not an external anti-bot service.

7.3 Password login

/login <password>

This is for accounts without an active required PIN. A correct password proceeds to 2FA when enabled. Only completing every required stage unlocks normal world access. Incorrect passwords increase the attempt counter. Do not send multiple commands at once: a previous operation may still be running, indicated by authentication_wait.

7.4 Changing a password

After logging in with a password account:

/changepass <old_password> <new_password> <new_password>

The old password, matching new copies and limits are checked. A successful save invalidates previous sessions. The current authenticated connection may remain active. A PIN account uses /changepass without arguments to change the PIN; removing the PIN with /rempin restores access to the password-change command with arguments.

7.5 Authentication timeout

settings.login_timeout is the limit in seconds, default 60; the main connection timeout has a minimum of 10 seconds. It also covers waiting for 2FA and mandatory Admin Guard setup. Starting another stage or closing the PIN GUI does not provide unlimited connection time. settings.message_interval controls registration/login reminders, not account validity.

8. PIN and GUI appearance

8.1 Enabling a PIN

Log in and enter /setpin without arguments.
Select the new PIN digits in the GUI, then enter them again to confirm.
Wait for the pin_saved confirmation.

The feature must be enabled with settings.pin.enabled: true. settings.pin.length sets the length of new PINs (1–9; an invalid value falls back to 6). Existing account PIN lengths remain unchanged when the default changes. Preserve leading zeroes.

8.2 PIN login

The GUI opens when PIN login is required. Click the digits; reaching the required length submits automatically. The arrow removes the last digit; clear removes the entire entry. A correct PIN proceeds to 2FA when enabled. /login <password> cannot bypass an active PIN. Sessions and Premium cannot bypass it on a new login; synchronization of an already authenticated proxy connection is a separate flow.

Closing the required login window halts that login flow. Reconnect or use previously configured recovery. The timeout still applies. Closing optional setup or change windows cancels that operation.

After PIN login on the lobby and transfer to another backend, valid synchronization closes any pending PIN login window on the destination. You do not need to enter the PIN again within the same authenticated proxy connection. An incorrect secret or rejected confirmation still requires normal authentication; Admin Guard remains mandatory. Voluntary PIN setup and change are separate from that login window. An obsolete PIN attempt no longer holds up new commands after synchronization.

8.3 Changing or removing a PIN

/changepass without arguments on an authenticated PIN account: current PIN → new PIN → confirmation.
/rempin after login: removes the PIN and returns to the retained password.
Global settings.pin.enabled: false: disables the GUI requirement and restores login with the retained password.

Administrators manage PINs with setpin, changepin and rempin in section 17. Successful password recovery can remove a forgotten PIN; it does not remove 2FA.

8.4 Customizing the GUI

The settings.pin.gui section in config.yml controls materials for digits, filler, input positions, status and buttons, plus textures and sounds. Material names must match the server version. Head textures are Base64 values pointing to the trusted textures.minecraft.net host; invalid values use the fallback material.

Edit captions, button names, lore and the window title in the selected Messages file: pin_gui_title, pin_gui_status_*, pin_gui_control_*, pin_gui_digit_0_name…pin_gui_digit_9_lore. Apply appearance and text changes with /pureauth reload. settings.pin.gui.sounds.enabled disables all GUI sounds; the remaining sound settings select opening, clicking, stage, success and error sounds.

9. 2FA and backup codes

9.1 Setting up an authenticator

Log in and enter /2fa setup. Mandatory Admin Guard setup may start automatically before full access.
Add the displayed secret to Aegis, 2FAS, Google Authenticator or another TOTP-compatible app.
Choose a time-based account: TOTP, 6 digits, 30-second period, SHA-1.
Enter the current code as a chat message. PureAuth intercepts this input for 2FA.
Wait for confirmation and store 5 backup codes of 8 characters each outside Minecraft.

Never share the 2FA secret. The synchronization secret in section 5 is different and does not belong in the authenticator. 2FA becomes active only after a correct confirmation code and successful save. An incorrect code during voluntary setup may end that attempt; run /2fa setup again. With Admin Guard, an incorrect code leaves mandatory setup active.

The default message displays a text key. Add it manually as a TOTP account. v6.3.1 does not generate a QR image. If you customize the message with a link to an external QR generator, consider that the service receives the secret.

9.2 Logging in with 2FA

After the correct password/PIN, enter the current six-digit code in chat. Full access is still restricted at this point. An incorrect code increases the login-attempt counter. Enable automatic time on the phone and time synchronization on the server; the current and adjacent 30-second windows are accepted.

9.3 Removing 2FA

After login, enter /2fa remove and confirm with a current code in chat. If you hold pureauth.admin.guard and Admin Guard applies, removal is blocked with admin_guard_remove_warning.

Successful 2FA removal by the owner preserves the current session. An external security reset or account lock still requires fresh authentication.

9.4 Lost phone: using a backup code

At the login 2FA stage, enter:

/2fa recovery <backup_code>

This is also available to an authenticated account. A correct code is one-use, disables 2FA and invalidates the entire previous code set, not just one code. The old set cannot be reused. Set up new 2FA with /2fa setup and keep the new codes. Admin Guard requires new setup before granting access.

An incorrect backup code counts as a failed authentication attempt. A recovery question or administrator password reset does not remove 2FA. This release has no dedicated administrator command for silently removing 2FA; resolve loss of every method according to your account-ownership verification policy.

10. Admin Guard

Admin Guard requires 2FA setup for players with pureauth.admin.guard when settings.admin_guard.enabled: true.

In your permission system, grant that node to the selected staff group or administrator.
On the next authentication, an account without 2FA remains restricted before full access.
The player sets up the authenticator and enters a code in chat. /2fa setup is allowed; other commands are blocked in this state.
Only a correct code and a successful saved setup complete login.

OP or pureauth.admin alone does not automatically grant pureauth.admin.guard. The node defaults to false and marks a security requirement rather than command access. Closing a window, entering an incorrect code or merely starting setup does not release Guard. The connection timeout applies. If you grant the node to an already logged-in player, verify it through a controlled fresh login.

11. Account recovery

11.1 Setting a question

With settings.recovery.enabled: true, log in and enter /recovery setup.
Enter the number of your selected question in chat.
Enter the answer. Choose one that is difficult to guess and keep it safe.
Wait for the save confirmation.

Leading/trailing spaces and letter case are ignored in the answer. The limit is 72 UTF-8 bytes. To change a question/answer, log in and use /recovery remove, then /recovery setup.

Questions are the recovery_questions message list. Keep existing entries in the same order with equivalent meanings in PL and EN. Reordering may assign a different question to a player. Append new questions at the end. Default questions can be easy to guess; encourage a strong, non-public answer stored in a password manager.

11.2 Recovering an account

Join without logging in.
Enter /recovery start.
Answer in chat. After a failure, run /recovery start again if the account is still unlocked.
After verification, enter /recovery pass <new_password> <new_password>.
After successful saving, reconnect and log in with the new password. Complete required 2FA/Admin Guard.

In v6.3.1, password recovery does not automatically grant world access. The recovery_pass_changed message tells the player to reconnect and log in with the new password. Recovery invalidates old sessions, removes a forgotten PIN and requires fresh authentication. Existing 2FA remains required. An earlier verified answer cannot overwrite newer security changes from another operation; restart recovery in that case.

A recovery session lasts at most 60 seconds from its start and ends on disconnect. The main connection timeout also applies. Typing cancel in chat while choosing a question or entering an answer cancels the flow; after verification, use the appropriate command or wait for expiry.

11.3 Three incorrect answers

The failed-answer counter survives reconnects and restarts. Every 3 incorrect answers advances the shared account-lock stage: 30 minutes → 24 hours → permanent lock with default settings. Stages share history with failed logins, so earlier penalties can advance escalation sooner.

Important for v6.3.1: recovery has a fixed threshold of 3 failures and a permanent third stage. Set durations with settings.security.progressive_lock.first_lock_seconds and second_lock_seconds; account_lock_enabled, progressive_lock.enabled, kicks_before_lock and max_attempts do not disable or change that recovery threshold. Unlock with /pureauth unlock <player>.

12. Progressive locks

Incorrect passwords, login PINs and login 2FA codes use the current connection's attempt counter (settings.max_attempts, default 3). Reaching the limit applies the next persistent penalty stage and disconnects the player.

Default stage	Trigger	Result
1	First recorded penalty stage	1800 s = 30 minutes
2	Second recorded penalty stage	86400 s = 24 hours
3	Third recorded penalty stage	Permanent lock until administrator action

These are successive groups of failures, not three individual mistakes immediately causing a permanent lock. The current connection's login-attempt counter and the persistent recovery-answer counter are different counters advancing shared penalty history.

Normal login policy uses account_lock_enabled, kicks_before_lock, progressive_lock.enabled and both durations. With account locking disabled, reaching the attempt limit can still cause a kick without a persistent account penalty. With progression disabled, the permanent-lock threshold still applies. Keep defaults for the behavior shown above. Recovery has its own rules in 11.3.

reset_history_after_successful_login: false keeps stage history after successful login. Enabling it clears escalation history on full successful authentication. Temporary expiry times survive restarts. Display is controlled by display.title, display.chat, display.actionbar and reminder_interval_seconds; edit temporary_lock_* and permanent_lock_kick for text.

An administrator uses /pureauth unlock <player> to remove permanent/temporary locks, penalty history, the recovery counter and Fair Play restrictions. It does not remove the password, PIN or 2FA. An online target may be disconnected to rejoin with fresh state. Unlocking PureAuth does not remove another plugin's ban.

13. Sessions and Premium Auto-Login

13.1 Short reconnect sessions

settings.sessions.enabled: true remembers an authenticated player after normal logout for settings.sessions.time_minutes minutes (default 1; minimum saved duration 1 minute). A session requires the same UUID, IP, current security settings and an unexpired lifetime.

LOCAL sessions belong to that instance and disappear on restart. REDIS lets modules with the same namespace share sessions. A plugin kick is not normal logout that creates a trusted session. PIN accounts still need their PIN on a new login, and accounts with 2FA still complete the required 2FA stage.

13.2 Premium Auto-Login

After login, enter /premium to enable the feature for your account. The plugin checks whether the name exists in Mojang's profile API. Connection and read timeouts are 5 seconds each; an API error does not enable Premium. With settings.premium_login.require_same_ip: true, the automatic first stage requires the last saved trusted IP. An IP change requires normal login. /cracked after authentication disables the Premium flag.

settings.premium_login.enabled controls availability. The Premium flag does not remove required PIN or 2FA. This is a name/IP convenience feature, not cryptographic verification of ownership of a Mojang session. People behind a shared NAT may use the same public IP. Consider your network's account model and forwarding; do not treat /premium alone as proof of an original launcher.

13.3 Revoking trust after changes

Changing security settings invalidates previous sessions and synchronization trust. An authenticated owner's change may keep their current connection active while revoking earlier sessions. Administrator password/PIN resets, account deletion and password recovery require fresh authentication.

Logout on other active backends may happen after a short delay, usually up to about 10 seconds. Messages include sessions_revoked and authentication_changed.

14. Ghost Mode and protection before login

Ghost Mode automatically hides the player from others, including players who join later. It is not a /vanish command or an administrator invisibility mode. Unauthenticated players should not see other unauthenticated players. Authenticated players remain visible under normal server rules.

PureAuth disables collision, optionally adds blindness (settings.blindness_effect) and prevents positional movement. After full login it restores the visibility it controls, the previous collision setting and any previous blindness effect. Disabling blindness_effect removes only that visual effect, not authentication or protection.

Items remain in the player's inventory. They cannot be used normally before authentication. Restrictions include:

movement, ordinary chat and commands unrelated to the current authentication stage;
breaking/placing blocks and interacting with the world, entities and armor stands;
inventory clicks/drags, item dropping/pickup and hand swapping;
attacking, including player projectiles, and damage received by the player;
consumption, hunger changes, mounting and portals.

The PIN GUI remains usable for authentication. Normal world commands remain blocked during 2FA/Admin Guard. Check other plugins' teleports, staff vanish and custom GUIs together on your server because they affect the same player behavior.

Set waiting areas while standing at the desired positions: /pureauth location login and /pureauth location register. Do not manually enter encoded settings.locations.* values. After login, the player may return to the last saved location; without one, the configured login point is used.

15. Redis and username protection

15.1 When to enable it

With multiple public proxies, select network.mode: REDIS on every module. Redis shares username reservations and sessions; MySQL still holds accounts, and synchronization requires section 5.

network:
  mode: "REDIS"
  sync:
    enabled: true
    shared_secret: "CHANGE_ME_GENERATE_WITH_OPENSSL_RAND_HEX_32"
  redis:
    host: "10.0.0.11"
    port: 6379
    username: "pureauth"
    password: "YOUR_REDIS_PASSWORD"
    database: 0
    key_prefix: "pureauth:"
    connection_timeout_ms: 2000
    socket_timeout_ms: 2000
    player_lock_ttl_seconds: 45
    authenticated_ttl_seconds: 600
    failure_policy: "DENY"

Replace the secret marker with the generator's result. All instances must use the same Redis server, database index and prefix. Use different prefixes for independent networks. Keep Redis on a private network with ACL/password and a firewall. v6.3.1 has no TLS configuration switch; do not assume any TLS-required endpoint can replace a normal host/port.

15.2 Preventing duplicate usernames

The proxy reserves usernames without regard to letter case and maintains reservations for active connections. Disconnecting releases a reservation; after a proxy crash it expires after the configured TTL. An unfinished connection should not reserve a name indefinitely.

TTL values below 10 seconds become 10; the default is 45 seconds. After a proxy crash, a name can remain occupied until the reservation expires. Do not manually remove it if the old proxy still has a live connection.

15.3 Failure behavior

DENY: new connections are rejected when username availability cannot be confirmed. This is the default protective policy.
ALLOW: failures may fall back to local protection; especially after startup failure, cross-proxy duplicate prevention is not guaranteed. Treat this as a deliberate emergency mode and check the console.

connection_timeout_ms limits connection establishment; socket_timeout_ms limits waiting for replies. authenticated_ttl_seconds sets shared authentication-state validity. Enabling Redis alone does not automatically authenticate a player: configure synchronization separately in section 5.

16. Fair Play Guard

Fair Play Guard organizes manual player inspections by administrators. It does not scan a player's computer or automatically detect cheats.

16.1 Preparing the location

Enable settings.fair_play_guard.enabled.
Grant the administrator pureauth.admin.check.setup.
Enter /pureauth check setup, move to the inspection location and enter /pureauth check setup confirm.
Set settings.fair_play_guard.discord_invite to your Discord invitation and customize fair_play_* messages.

The saved location includes the world, coordinates and orientation. Do not manually edit settings.locations.fair_play_check. With safe_mode enabled, player-issued Fair Play commands are blocked; prepare this player-only location during a controlled setup window with safe mode disabled, then restore the policy.

16.2 Starting an inspection

/pureauth check <player>

Requires pureauth.admin.check.start. The target must be online and, by default, authenticated (require_authenticated). The previous location, game mode and flight settings are retained; the player is teleported to the inspection point, normally switched to Adventure and has flight disabled. Instructions and repeated reminders are shown.

Individual switches control drops, inventory clicks, blocks/interactions, commands and received damage. Check compatibility with other plugins affecting player behavior. The default radius is 50 blocks in 3D; another world is outside the area. Radius enforcement runs every check_interval_ticks ticks and reminders every interval_seconds seconds.

block_inventory_changes blocks both clicks and item dragging during an active inspection. Clearing the inspection removes both restrictions; setting the option to false disables both. prevent_damage protects the target from receiving damage; it is not a switch preventing outgoing attacks.

With private_chat: true, the target's messages go to the inspector instead of global chat. The console receives them if it started the inspection. Ordinary administrator messages do not automatically become private replies; use the appropriate communication channel on your server.

16.3 Clearing without a penalty

/pureauth check clear <player>

Requires pureauth.admin.check.clear. Removes active restrictions and can clear an offline player's persistent Fair Play lock. During an active inspection, location and flight are restored according to saved settings. restore_survival_mode: true specifically restores Survival; false restores the previous game mode. Set restore_previous_location to return players to their pre-inspection position.

16.4 Disconnects, kicks and bans

lock_on_disconnect: true stores a restriction when a player leaves during an inspection. Future joins are rejected with fair_play_lock_kick; customize this message with your appeal procedure. Independently, enable disconnect_command.enabled and set a console command with %player% and %uuid%, such as a command from your punishment system. Omit the initial /.

A detected administrator ban ends temporary inspection restrictions without an additional leaving penalty. Detection uses the Paper kick reason, name bans and command roots in ban_detection.command_prefixes. Add the proper root for another punishment plugin. The supported pattern expects the target as the first command argument; custom syntax may need manual handling.

/pureauth check clear <player> clears the Fair Play penalty; /pureauth unlock <player> also clears other account locks. Remove another plugin's ban with its own command. Before a planned shutdown, preferably end inspections with check clear. Normal plugin shutdown restores inspections that remain active; check the effect of player-disconnection order during a full server stop in your environment. Do not assume an ongoing inspection automatically resumes after a full server crash. A previously saved disconnect penalty remains active.

17. Administrator commands

/pa is an alias for /pureauth. A player issuing commands must first finish authentication. Proxy account-management commands do not replace Paper commands: run these operations on a backend or its console.

Command completion: type /pureauth or /pa with a trailing space and press TAB. Suggestions include subcommands allowed by your permissions. A partial name narrows the list, for example /pureauth re. TAB also completes location and check arguments and visible online player names where appropriate. Missing suggestions can mean missing permissions; stats is console-only. Password/PIN positions do not suggest player names.

Command	Required permission	Exact behavior and usage
`/pureauth`	No separate node	Version and author; does not display the secret.
`/pureauth reload`	`pureauth.admin.reload`	Reload described in section 23.
`/pureauth stats`	`pureauth.admin.stats`	Console only; account count and selected feature statuses.
`/pureauth unlock <player>`	`pureauth.admin.unlock`	Clears account locks, history and Fair Play; an online player rejoins.
`/pureauth unregister <player>`	`pureauth.admin.unregister`	Permanently deletes the account; an online player must rejoin/register. Verify the target and keep a backup first.
`/pureauth register <player> <password>`	`pureauth.admin.register`	Creates an account administratively. With UUID forwarding and online accounts, create it for the correctly connected player to ensure the right identity. This is not the ordinary CAPTCHA/IP-limit flow.
`/pureauth forcelogin <player>`	`pureauth.admin.forcelogin`	Manually completes an online player's login. Powerful permission: bypasses manual password/PIN/2FA proof. Account, security, lock and mandatory Admin Guard setup checks still apply. Verify ownership independently first.
`/pureauth info <player>`	`pureauth.admin.info`	Displays UUID, IP, dates and account flags; not a plaintext password.
`/pureauth setpassword <player> <new_password>`	`pureauth.admin.setpassword`	Resets the password and revokes old authentication; does not automatically remove PIN or 2FA.
`/pureauth accounts <ip>`	`pureauth.admin.accounts`	Lists accounts associated with a recorded IP.
`/pureauth location login`	`pureauth.admin.location`	A player saves their current position as the login point.
`/pureauth location register`	`pureauth.admin.location`	A player saves the registration point.
`/pureauth setpin <player> <pin>`	`pureauth.admin.pin`	Sets the account's first PIN; supply digits of the required length.
`/pureauth changepin <player> <pin>`	`pureauth.admin.pin`	Changes an existing PIN.
`/pureauth rempin <player>`	`pureauth.admin.pin`	Removes the target's PIN; the retained password becomes the login method.
`/pureauth check setup`	`pureauth.admin.check.setup`	A player begins choosing the Fair Play location.
`/pureauth check setup confirm`	`pureauth.admin.check.setup`	A player saves their current position.
`/pureauth check <player>`	`pureauth.admin.check.start`	Starts a manual inspection.
`/pureauth check clear <player>`	`pureauth.admin.check.clear`	Ends an inspection / clears a persistent Fair Play penalty.

Use the exact subcommands shown. v6.3.1 has no separate /pureauth secret, /pureauth backup or administrator /pureauth 2fa remove command. The help argument is not a separate way to change settings.

Safe mode

With settings.safe_mode: true, sensitive changes are console-only: unlock, unregister, register, forcelogin, setpassword, PIN operations and check. A player's permissions do not bypass safe mode. reload, info/accounts reads and login/register location setup keep their normal checks; stats is always console-only. TAB suggestions depend on permissions.

18. Permissions

The table covers every plugin permission. op means granted to operators by default. Player commands /register, /login, /changepass, /setpin, /rempin, /premium, /cracked, /2fa and /recovery have no separate access permissions; account and authentication state determine availability.

Permission	Default	Meaning
`pureauth.admin`	op	Parent of all administrator permissions except Admin Guard.
`pureauth.admin.reload`	op	Reload configuration and messages.
`pureauth.admin.stats`	op	Console statistics.
`pureauth.admin.unlock`	op	Unlock accounts.
`pureauth.admin.unregister`	op	Delete accounts.
`pureauth.admin.register`	op	Create accounts administratively.
`pureauth.admin.forcelogin`	op	Manually authenticate an online player.
`pureauth.admin.info`	op	View account information.
`pureauth.admin.setpassword`	op	Administrator password reset.
`pureauth.admin.accounts`	op	List accounts associated with an IP.
`pureauth.admin.location`	op	Set login and registration waiting points.
`pureauth.admin.pin`	op	Set/change/remove another account's PIN.
`pureauth.admin.guard`	false	Marks mandatory 2FA setup; does not grant command access.
`pureauth.admin.check`	op	Parent of the three Fair Play Guard permissions.
`pureauth.admin.check.start`	op	Start inspections.
`pureauth.admin.check.setup`	op	Set the inspection location.
`pureauth.admin.check.clear`	op	End inspections / clear Fair Play penalties.

Grant individual permissions appropriate to the role. pureauth.admin.check groups start/setup/clear. pureauth.admin groups administrative permissions except the pureauth.admin.guard requirement.

19. Database and performance

Choose SQLite for one server and MySQL/MariaDB for shared network accounts. A table prefix should contain only letters, digits and underscores. Use the same database and prefix across the network; changing a prefix can make existing accounts appear missing.

database.pool settings limit database connections and waiting times. Keep a maximum of 1 connection for SQLite. Paper's automatic values (-1) select a maximum of 1 for SQLite and 16 for MySQL, with minimum idle respectively 1 and up to 4. Proxy templates use maximum 16 and minimum idle 4. Limits apply per instance: 10 backends with 16 connections each can use up to 160 connections plus proxies.

performance.async lets you adjust database, cryptography and network capacity to your host. The generated configuration uses 8/4/4 threads and a queue of 512. Cryptography threads are additionally capped at available processors minus one, with a minimum of 1. SQLite has a connection pool of 1; the number of database tasks does not change that connection limit. Supported ranges and setting meanings are in section 26. Raising every value together can increase CPU or database load.

authentication_wait means the previous operation is still running; wait before retrying. authentication_busy indicates temporary overload; try again shortly. performance.request_interval_ms sets the minimum interval between new authentication commands: 250 ms by default, supported range 0–10000 ms. Even at 0, a request must wait for the previous operation to finish. PIN digits and private answers do not use the same fixed interval, but still have a limit on concurrent work. After authentication_busy, reconnect shortly.

A sudden influx of players can increase password-work waiting time even while TPS remains healthy. Measure login latency as well and choose settings.login_timeout for your CPU and actual traffic; enlarging a queue does not make computations faster.

Monitor CPU, database latency, MSPT and TPS under actual traffic. Check the database, Redis, access to external services and bot traffic before changing limits. Settings cannot guarantee zero resource use.

If the database or required Redis cannot start correctly, new connections remain blocked. Fix the cause shown in the console and restart the instance.

20. Messages and notifications

20.1 Where to edit text

Paper and BungeeCord:

plugins/PureAuth/Messages/PL_pl.txt
plugins/PureAuth/Messages/EN_en.txt

Velocity, in its own proxy directory:

plugins/pureauth/Messages/PL_pl.txt
plugins/pureauth/Messages/EN_en.txt

In config.yml, select settings.language: "PL" or "EN". The .txt files use YAML syntax. Preserve keys, indentation, lists and quotation marks. Quote values containing :, # or special characters. Double-quoted text may use \n for a new line. Colors: &a, &c, &l and &#RRGGBB.

Example edits to existing keys:

prefix: "&8[&bPureAuth&8] &r"
sync_success: "&aAuthenticated through a trusted proxy."
sync_rejected: "&cSynchronization could not be confirmed. Please log in normally."
sync_configuration_invalid: "&cSet the same random synchronization secret on proxies and backends."
authentication_wait: "&eYour previous operation is still running. Please wait."
authentication_busy: "&cAuthentication is temporarily busy. Try again shortly."
sessions_revoked: "&cYour account security settings changed. Please log in again."
admin_guard_remove_warning: "&cComplete 2FA setup before accessing the server."

Edit the existing key instead of adding a second definition. Apply Paper changes with /pureauth reload; restart proxies after editing their messages. Backend reload does not reload its proxy. The local duplicate-username rejection message also updates with /pureauth reload.

At startup, Paper adds new missing keys while preserving custom values. A missing key may fall back to EN; missing/invalid files cause warnings. Keep both files complete. Apply changes to custom text and English fallback text with /pureauth reload, including connection-rejection messages.

20.2 Which notification matches each situation

sync_success: successful proxy-assisted login; sync_rejected: rejected confirmation.
sync_configuration_invalid: synchronization needs a valid secret.
authentication_wait / authentication_busy: operation still running / temporary overload.
authentication_changed / sessions_revoked: security changes and a need for fresh verification.
recovery_fail and temporary_lock_* / permanent_lock_kick: recovery failure and resulting locks.
admin_guard_*: mandatory administrator 2FA setup.
startup_unavailable: protection is not ready to accept players safely.
network_duplicate_kick / network_unavailable_kick: a duplicate network username / network service unavailable.

Changing text does not change security rules. Messages depend on enabled features and the player's situation. Not all technical logs or Discord notification text can be changed in Messages.

20.3 Message variables

Variable	Meaning in the relevant message
`%player%`, `%admin%`	Player / inspector or administrator
`%message%`, `%discord%`, `%reason%`	Private inspection message, Discord invitation, restriction reason
`%time%`, `%seconds%`	Remaining time in the format used by that key
`%code%`, `%key%`, `%codes%`	CAPTCHA / TOTP secret / backup-code block
`%question%`, `%number%`	Question / its number
`%length%`, `%attempts%`, `%max%`	Required length / attempt count / limit
`%current%`, `%new%`, `%version%`	Update or plugin versions
`%count%`, `%value%`, `%accounts%`	Count, statistic value, account list
`%error%`	Error description in selected messages
`%uuid%`, `%ip%`, `%last_login%`, `%registered%`, `%premium%`, `%pin_enabled%`, `%locked%`, `%temporary_lock_until%`, `%failed_login_kicks%`, `%recovery_set%`, `%2fa_enabled%`	Account information template fields

Use variables intended for the particular message; elsewhere they may remain literal text. Message variables are separate from PlaceholderAPI in section 22. The complete key index and English text are in section 28.

21. Backups and restoration

settings.backup.enabled enables scheduled backups. The first runs after interval_hours hours, not immediately on startup. The interval must be positive. Files are stored on the backend in plugins/PureAuth/backups/; max_backups limits rotation, default 10. Rotation removes only older PureAuth backup files. A max_backups value below 1 is treated as 1.

SQLite creates database_<date>.db files; MySQL creates mysql_dump_<date>.sql. The v6.3.1 MySQL export requires an existing compatible database structure when restoring. It is not a standalone full backup. Maintain an additional complete MySQL/MariaDB backup containing structure and data.

A new backup appears as a completed file only after writing finishes. A failed backup does not replace previous backups or trigger their rotation. On systems with POSIX permissions, new backups are accessible only to the file owner. SQL exports also preserve backslashes, control characters and Unicode.

To restore:

Stop every process writing account data and keep a copy of the current state.
For SQLite, restore a verified file as plugins/PureAuth/database.db while the server is stopped and SQLite companion files are in a consistent state.
For MySQL, restore a full backup to the correct schema. Before using a plugin export, ensure compatible structure and avoid duplicating existing accounts.
Restore the matching configuration/prefix and file permissions, start modules and check several accounts and locks.
Check configuration, locations and messages too: account-data backups do not replace them.

There is no /pureauth backup or /pureauth restore command. Keep copies off-host and practice restores in a test environment. The database contains sensitive information, including 2FA secrets; protect backup access.

22. Discord, logs, PlaceholderAPI and updates

22.1 Discord webhook

Create a webhook in a Discord channel intended for administration events.
Enter its URL in settings.discord.webhook_url and set settings.discord.enabled to true.
Enable only the required settings.discord.events.* switches.
Save, reload and check an event that is actually sent.

Notifications cover login (user_login), password/PIN changes (user_changepass), failed-attempt limits (failed_attempts), locks (account_locked), supported administrative commands (admin_usage, admin_sensitive), registration (user_register), enabling/disabling Premium (user_premium_toggle) and successful module startup/shutdown (server_lifecycle). Registration/Premium notifications follow a successful save, not a rejected attempt or database failure. Enabling Premium also requires a positive API response. Enable both the category switch and the master Discord switch.

Up to 16 notifications may be pending. Excess notifications are dropped without a persistent queue or guaranteed retry; each request has a 5-second timeout. Discord is not a substitute for the audit log. Not all text and titles are editable. Treat the webhook URL as an access secret.

22.2 Administrative log

Backend actions are recorded in plugins/PureAuth/pureauth.log. Password/PIN arguments for administrative register, setpassword, setpin and changepin commands are replaced with [REDACTED] in this log. The plugin also suppresses standard Paper entries that echo complete authentication commands and sensitive PureAuth commands, preventing plaintext passwords, PINs and recovery codes from entering those entries. This protection is automatic. Earlier entries are not removed; protect and rotate historical logs after upgrading. Redaction also covers every extra argument following the password/PIN position, even when the command is malformed. If a secret was previously written to a historical log, change it and restrict access to that log. This does not guarantee masking in other command-monitoring plugins, hosting-panel history or proxy consoles. Manage log access and rotation separately.

22.3 PlaceholderAPI

PlaceholderAPI is optional; install it on a backend when another plugin needs to display PureAuth status. Available placeholders are:

Placeholder	Result
`%pureauth_logged%`	`true` for an online player who has fully logged in, otherwise `false`
`%pureauth_has_2fa%`	`true` / `false` for the player's known 2FA status

Use the second placeholder to display a player's server status, not as a tool for inspecting arbitrary offline accounts. Example using PlaceholderAPI: /papi parse me %pureauth_logged%. This is a PlaceholderAPI command, not a PureAuth command. No other PureAuth placeholders are available in this release.

22.4 Update checking

settings.update_checker: true checks Modrinth for updates during startup. A newer version generates a console notice and notifies players with pureauth.admin. Player messages are update_available and update_download. Version numbers are compared semantically. The plugin does not automatically download or install a new JAR. Restart to change whether this service starts.

23. Reloading and restarting

Change	How to apply
Paper messages and language	`/pureauth reload`, including duplicate-name rejection text
PIN settings/appearance	`/pureauth reload`
Backup schedule	`/pureauth reload` — restarts the schedule
Fair Play Guard intervals	`/pureauth reload` — adjusts schedules
Database, driver, prefix, connection pool	Full restart of the instance
LOCAL/REDIS, Redis endpoint/password	Full restart of every affected instance
Synchronization secret / enablement	Full restart of proxies and backends after a consistent change
Thread counts, queues and `performance.request_interval_ms`	Full restart
Proxy configuration and messages	Proxy restart
New JAR / enabling update checking	Restart

/pureauth reload does not switch existing SQL/Redis connections or replace a full restart. Do not use the server-wide /reload or hot-unload JAR tools as an upgrade procedure. Perform a controlled stop and start.

24. Troubleshooting

Synchronization fails after switching backends

Check 5.2–5.5: proxy and every backend, correct paths, one network: section, enabled: true, one generated 64-character secret, shared database/prefix and consistent UUID. All JARs must be v6.3.1. Check pureauth:sync, system time and completion of the first full login. Redis alone does not activate synchronization. Restart the proxy too.

`sync_configuration_invalid` or `sync_rejected`

The first usually indicates an invalid secret configuration; the second means confirmation was rejected. Causes include different secrets, an old confirmation, an inconsistent player identity or changed account security settings. Log in normally and fix the configuration rather than disabling verification. Message text is not where the secret belongs.

Username occupied although nobody appears online

Check every proxy and wait at least the full reservation TTL after the old connection ends. Verify Redis, the shared namespace and absence of a second live connection. The TTL may not have expired after a crash. Do not use Redis FLUSHDB as a routine repair.

Redis is unavailable

Check the private address, port, ACL, password, database index and timeouts. DENY deliberately rejects entries without protection confirmation. ALLOW weakens multi-proxy protection; after repair, verify the active mode and restart modules that fell back locally during startup.

Every player receives `startup_unavailable`

Check the earliest console error: SQL/Redis, YAML, folder permissions and backend online-mode. PureAuth keeps new connections blocked when protection fails to start. Fix the cause and restart the instance.

Password login fails on a PIN account

This is expected if PIN is the active method. Use the GUI or previously configured recovery. Reconnect after closing a required GUI; do not try to bypass it with a /login alias. An administrator password reset does not remove the PIN; an administrator can separately use rempin.

Recovery rejects the question or expires

Check that recovery is enabled, the question is saved and recovery_questions order has not changed. start requires an existing account that is not fully logged in. Recovery lasts 60 seconds and the connection has a separate timeout. Three incorrect answers cause a penalty across reconnects too. Disconnection and fresh login after password recovery are expected.

An administrator has no access after a correct password

Check pureauth.admin.guard. Complete valid TOTP setup and keep backup codes. A correct code alone is insufficient if saving to SQL fails. Do not accidentally grant Guard to every player through a permission group.

The 2FA code is incorrect

Check the account's secret, TOTP/SHA-1/6 digits/30 seconds, and phone/host time. Do not enter a code belonging to another server. Wait briefly between attempts because input is rate limited. Use a backup code if the app is lost.

The Fair Play location is missing or a player was locked after a ban

Set the location again in an existing loaded world. For an external punishment plugin, add the correct ban command root and account for the supported target syntax. Use check clear or unlock to remove the PureAuth penalty; a separate ban needs separate handling.

Messages or colors did not change

Edit the correct instance and language file. Check YAML, duplicate keys and list types. Reload Paper; restart proxies. Technical console text and some embeds are not Messages settings.

A player is visible or remains hidden during login

Check whether 2FA/Admin Guard actually finished and whether another plugin controls vanish/visibility. PureAuth hides players without removing items. Reproduce with two clients: first an unauthenticated player, then a newly joining observer, then a full login. Record visibility-plugin versions and the circumstances before reporting a problem.

`authentication_wait`, `authentication_busy` or TPS drops

Do not submit parallel attempts. Check CPU, SQL latency, Redis/Mojang availability, bot traffic and thread settings. Distinguish plugin, database and overall host load; do not raise every limit without evidence. Limited queues prevent an unlimited backlog.

25. Checking your own server after installation

After installation, use separate test accounts to check:

All modules start/stop, SQL initializes, no errors occur, and controlled startup failure blocks new connections in a test environment.
Registration with/without CAPTCHA, password/72-byte limits, the IP account limit, normal login and password changes.
PIN setup, login, incorrect digits, change, removal, GUI closing and continued timeout enforcement.
2FA setup, correct/incorrect codes, login, removal, backup-code use and rejection of the old set.
Admin Guard blocks world access before saved 2FA, an incorrect code does not release protection, and required 2FA cannot be removed.
Recovery question setup/change/removal, expiry, password/PIN reset without removing 2FA; three failures across reconnects, penalty stages and unlock.
Sessions with the correct IP, rejection for a different IP/security change; Premium and required extra stages separately.
Synchronization secret: successful A→B switching on one proxy, rejection of mismatched configuration and fresh authentication after security changes.
Redis: one name through two proxies simultaneously, reservation release, crash TTL and expected DENY/ALLOW behavior in a controlled environment.
Ghost Mode with two clients before/after an observer joins; inventory retention, collision, previous blindness and interaction restrictions.
Fair Play setup, start, chat, radius, restrictions, clear, disconnect, persistent penalty, appeal handling, your punishment system's ban and normal shutdown.
Permissions and safe mode, PL/EN, proxy messages, backups and a restore rehearsal, webhook and both placeholders.
CPU/MSPT/TPS under traffic representative of your network.

26. Complete Paper configuration

The table covers every setting in Paper v6.3.1 config.yml. A dotted path represents YAML nesting, not a single key containing dots. Defaults match the configuration generated at installation. "" means empty text. Long head textures are marked “included Base64 texture”; keep the generated value unless you want to change the appearance.

Path	Default	Meaning
`database.type`	SQLITE	Storage type: SQLITE for a standalone server, MYSQL for a shared network.
`database.pool.maximum_pool_size`	-1	Maximum database connections; -1 selects Paper defaults (SQLite 1, MySQL 16). Proxy default: 16.
`database.pool.minimum_idle`	-1	Minimum idle connections; -1 selects automatically. Proxy default: 4.
`database.pool.connection_timeout_ms`	10000	Maximum wait for a pooled database connection, in milliseconds.
`database.pool.idle_timeout_ms`	600000	Idle duration before surplus connections may close, in milliseconds.
`database.pool.max_lifetime_ms`	1800000	Maximum connection age, in milliseconds; keep compatible with SQL server limits.
`database.mysql.host`	localhost	MySQL/MariaDB host/IP.
`database.mysql.port`	3306	MySQL/MariaDB port.
`database.mysql.database`	minecraft	SQL schema name, identical across the network.
`database.mysql.username`	root	Dedicated database user.
`database.mysql.password`	password	SQL user password.
`database.mysql.table_prefix`	pureauth_	Table prefix: letters, digits and underscores.
`performance.request_interval_ms`	250	Minimum interval between new player commands, in ms; range 0–10000, one player operation at a time. Restart required.
`performance.async.database_threads`	8	Database task threads; range 1–32. SQLite still has a connection pool of 1.
`performance.async.crypto_threads`	4	Cryptography threads; range 1–32, also capped at available processors minus one, minimum 1.
`performance.async.network_threads`	4	Network task threads; range 1–32.
`performance.async.queue_size`	512	Maximum queue per group; range 1–4096. Excess work is rejected; measure before increasing.
`network.mode`	LOCAL	LOCAL for local state; REDIS for shared multi-proxy coordination. Does not enable synchronization by itself.
`network.sync.enabled`	false	Enables secure proxy/backend authentication synchronization; both sides need a valid secret.
`network.sync.shared_secret`	""	The same random secret on every proxy and backend; minimum 32 characters, recommended 64 hex characters from OpenSSL. See section 5.
`network.redis.host`	localhost	Redis host/IP shared by network modules.
`network.redis.port`	6379	Redis TCP port.
`network.redis.username`	""	Redis ACL username; empty uses the default user.
`network.redis.password`	""	Redis/ACL password, separate from the synchronization secret.
`network.redis.database`	0	Redis logical database index.
`network.redis.key_prefix`	pureauth:	Shared namespace for one network; use a distinct prefix for independent networks. A trailing colon is normalized.
`network.redis.connection_timeout_ms`	2000	Redis connection establishment limit, in milliseconds.
`network.redis.socket_timeout_ms`	2000	Redis reply timeout, in milliseconds.
`network.redis.player_lock_ttl_seconds`	45	Username reservation validity, in seconds; minimum 10, normally renewed about every TTL/3.
`network.redis.authenticated_ttl_seconds`	600	Shared authentication-state validity; does not replace synchronization settings.
`network.redis.failure_policy`	DENY	DENY rejects unprotected connections; ALLOW permits local fallback without multi-proxy guarantees.
`settings.safe_mode`	false	Restricts sensitive administrator changes to the console; see section 17.
`settings.language`	EN	PL selects PL_pl.txt; EN selects EN_en.txt. Other values fall back to EN.
`settings.blindness_effect`	true	Adds blindness before login; does not disable hiding or world restrictions.
`settings.premium_login.enabled`	true	Enables Premium Auto-Login and /premium.
`settings.premium_login.require_same_ip`	true	Requires the last trusted IP for the automatic Premium first stage.
`settings.pin.enabled`	true	Enables PIN as the primary method; false allows the retained password.
`settings.pin.length`	6	New PIN length, 1–9; invalid values become 6. Existing account lengths stay unchanged.
`settings.pin.gui.digit_material`	PLAYER_HEAD	Fallback GUI digit material.
`settings.pin.gui.filler.material`	GRAY_STAINED_GLASS_PANE	Material for unused GUI slots.
`settings.pin.gui.input.filled.material`	LIME_STAINED_GLASS_PANE	Material marking an entered digit.
`settings.pin.gui.input.empty.material`	BLACK_STAINED_GLASS_PANE	Material for an empty PIN position.
`settings.pin.gui.status_material`	NETHER_STAR	Status/instruction item material.
`settings.pin.gui.controls.backspace.material`	ARROW	Button material for removing the last digit.
`settings.pin.gui.controls.backspace.texture`	""	Optional Base64 texture for removing the last digit; empty uses the material.
`settings.pin.gui.controls.clear.material`	BARRIER	Button material for clearing the entire entry.
`settings.pin.gui.controls.clear.texture`	""	Optional Base64 texture for clearing the entire entry; empty uses the material.
`settings.pin.gui.digits.0.texture`	included Base64 texture	Base64 texture for digit 0 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.1.texture`	included Base64 texture	Base64 texture for digit 1 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.2.texture`	included Base64 texture	Base64 texture for digit 2 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.3.texture`	included Base64 texture	Base64 texture for digit 3 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.4.texture`	included Base64 texture	Base64 texture for digit 4 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.5.texture`	included Base64 texture	Base64 texture for digit 5 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.6.texture`	included Base64 texture	Base64 texture for digit 6 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.7.texture`	included Base64 texture	Base64 texture for digit 7 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.8.texture`	included Base64 texture	Base64 texture for digit 8 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.digits.9.texture`	included Base64 texture	Base64 texture for digit 9 using a trusted textures.minecraft.net URL; name/lore are in Messages.
`settings.pin.gui.sounds.enabled`	true	Master GUI sound switch.
`settings.pin.gui.sounds.open`	minecraft:block.ender_chest.open	GUI opening sound key.
`settings.pin.gui.sounds.click`	minecraft:ui.button.click	GUI clicking sound key.
`settings.pin.gui.sounds.step`	minecraft:block.note_block.pling	GUI stage transition sound key.
`settings.pin.gui.sounds.success`	minecraft:entity.player.levelup	GUI success sound key.
`settings.pin.gui.sounds.error`	minecraft:entity.villager.no	GUI error sound key.
`settings.backup.enabled`	true	Scheduled backend backups.
`settings.backup.interval_hours`	24	Hours between backups and before the first backup; must be positive.
`settings.backup.max_backups`	10	Retained backups created by PureAuth; minimum 1. Older backups are removed after a new backup succeeds.
`settings.recovery.enabled`	true	Enables account recovery question flows.
`settings.discord.enabled`	false	Master Discord webhook switch.
`settings.discord.webhook_url`	YOUR_WEBHOOK_HERE	Secret Discord webhook URL; replace it with your own.
`settings.discord.events.server_lifecycle`	true	Notifications for successful module startup and shutdown.
`settings.discord.events.user_login`	false	Webhook filter: successful login; requires enabled integration and an available event in this category.
`settings.discord.events.user_register`	true	Successful registration notification after the account is saved.
`settings.discord.events.user_changepass`	true	Webhook filter: password changes; requires enabled integration and an available event in this category.
`settings.discord.events.user_premium_toggle`	true	Successful Premium enable/disable notifications after saving.
`settings.discord.events.failed_attempts`	true	Webhook filter: exceeded failed attempts; requires enabled integration and an available event in this category.
`settings.discord.events.account_locked`	true	Webhook filter: account locks; requires enabled integration and an available event in this category.
`settings.discord.events.admin_usage`	true	Webhook filter: ordinary administrator actions; requires enabled integration and an available event in this category.
`settings.discord.events.admin_sensitive`	true	Webhook filter: sensitive administrator actions; requires enabled integration and an available event in this category.
`settings.security.account_lock_enabled`	true	Persistent penalties for ordinary failed logins; does not disable the separate three-answer recovery policy.
`settings.security.kicks_before_lock`	3	Ordinary login penalty-stage threshold for permanent locking; recovery has a fixed three-stage threshold.
`settings.security.progressive_lock.enabled`	true	Enables temporary stages for ordinary login; recovery retains its separate progression.
`settings.security.progressive_lock.first_lock_seconds`	1800	First lock duration in seconds; recovery uses at least 1 second.
`settings.security.progressive_lock.second_lock_seconds`	86400	Second lock duration in seconds; recovery requires it to exceed the first duration.
`settings.security.progressive_lock.reset_history_after_successful_login`	false	Whether a full successful login clears escalation history.
`settings.security.progressive_lock.reminder_interval_seconds`	10	Interval for temporary-lock reminders.
`settings.security.progressive_lock.display.title`	true	Show lock status as a title.
`settings.security.progressive_lock.display.chat`	true	Show lock status as a chat message.
`settings.security.progressive_lock.display.actionbar`	true	Show lock status as a actionbar.
`settings.captcha.enabled`	true	Requires a CAPTCHA argument during registration.
`settings.captcha.length`	5	Length 1–32; the longest possible generated code must fit within 72 UTF-8 bytes. Recommended: 5–8.
`settings.captcha.characters`	ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789	Literal alphabet of 2–256 characters with at least two distinct ones, without whitespace, control characters or characters outside U+0000–U+FFFF; A-Z is not a range.
`settings.login_timeout`	60	Seconds to authenticate, including 2FA/Admin Guard; main timeout minimum 10 seconds.
`settings.max_attempts`	3	Incorrect login attempts in a connection before a penalty; does not change the recovery threshold.
`settings.min_password_length`	4	Minimum password characters; the separate 72 UTF-8 byte limit still applies.
`settings.max_accounts_per_ip`	3	Account limit per recorded IP during standard registration, including shared network accounts.
`settings.sessions.enabled`	true	Short reconnect trust after normal logout; requires matching IP and current security settings.
`settings.sessions.time_minutes`	1	Session duration in minutes; minimum saved duration 1.
`settings.admin_guard.enabled`	true	Requires 2FA for pureauth.admin.guard holders before full access.
`settings.fair_play_guard.enabled`	true	Master Fair Play Guard switch.
`settings.fair_play_guard.require_authenticated`	true	Requires the target to finish login before inspection.
`settings.fair_play_guard.teleport_to_check_location`	true	Teleports the target to the configured inspection point.
`settings.fair_play_guard.force_adventure_mode`	true	Uses Adventure mode during inspection.
`settings.fair_play_guard.block_item_drops`	true	Blocks item dropping.
`settings.fair_play_guard.block_inventory_changes`	true	Blocks supported inventory clicks during inspection.
`settings.fair_play_guard.block_world_interaction`	true	Blocks breaking/placing blocks and world interaction.
`settings.fair_play_guard.block_commands`	true	Blocks the inspected player's commands.
`settings.fair_play_guard.prevent_damage`	true	Prevents damage received by the inspected player.
`settings.fair_play_guard.private_chat`	true	Sends target chat to the inspector/console instead of global chat.
`settings.fair_play_guard.lock_on_disconnect`	true	Stores a Fair Play penalty for leaving unless recognized as an administrator ban.
`settings.fair_play_guard.restore_previous_location`	true	Returns the player to their pre-inspection location when cleared.
`settings.fair_play_guard.restore_survival_mode`	true	True restores Survival; false restores the original game mode.
`settings.fair_play_guard.discord_invite`	discord.gg/yourserver	Inspection invitation substituted for %discord%.
`settings.fair_play_guard.radius.enabled`	true	Enables distance enforcement around the inspection center.
`settings.fair_play_guard.radius.max_distance`	50.0	Maximum 3D distance in blocks; another world is outside the area.
`settings.fair_play_guard.radius.check_interval_ticks`	20	Radius check interval in ticks; minimum 1.
`settings.fair_play_guard.reminders.enabled`	true	Repeated instructions for the inspected player.
`settings.fair_play_guard.reminders.interval_seconds`	10	Reminder interval in seconds; minimum 1.
`settings.fair_play_guard.disconnect_command.enabled`	false	Independently runs a custom console command on an inspection disconnect.
`settings.fair_play_guard.disconnect_command.command`	ban %player% Disconnected during a Fair Play Guard inspection	Command without /; supports %player% and %uuid%, independently of PureAuth penalty storage.
`settings.fair_play_guard.ban_detection.command_prefixes`	ban; minecraft:ban; tempban; litebans:ban; advancedban:ban	Command roots recognized as bans; the target is expected as the first argument.
`settings.update_checker`	true	Checks Modrinth during startup; does not install updates automatically.
`settings.message_interval`	10	Seconds between login/registration reminders.
`settings.locations.spawn_login`	""	Encoded login point; set with /pureauth location login.
`settings.locations.spawn_register`	""	Encoded registration point; set with /pureauth location register.
`settings.locations.fair_play_check`	""	Encoded inspection point; set with check setup and confirm.

27. Complete BungeeCord and Velocity configuration

Shared network, Redis and database connection settings are explained in sections 5, 15 and 19. Do not replace a proxy configuration with the entire Paper config. Proxies do not provide their own PIN GUI or Paper administrator commands. BungeeCord uses database.type and database.mysql.*; Velocity uses database.driver and flat database settings.

27.1 BungeeCord

Path	Default	Meaning
`database.type`	MYSQL	Storage type: SQLITE for a standalone server, MYSQL for a shared network.
`database.pool.maximum_pool_size`	16	Maximum database connections; -1 selects Paper defaults (SQLite 1, MySQL 16). Proxy default: 16.
`database.pool.minimum_idle`	4	Minimum idle connections; -1 selects automatically. Proxy default: 4.
`database.pool.connection_timeout_ms`	10000	Maximum wait for a pooled database connection, in milliseconds.
`database.pool.idle_timeout_ms`	600000	Idle duration before surplus connections may close, in milliseconds.
`database.pool.max_lifetime_ms`	1800000	Maximum connection age, in milliseconds; keep compatible with SQL server limits.
`database.mysql.host`	localhost	MySQL/MariaDB host/IP.
`database.mysql.port`	3306	MySQL/MariaDB port.
`database.mysql.database`	pureauth	SQL schema name, identical across the network.
`database.mysql.username`	root	Dedicated database user.
`database.mysql.password`	""	SQL user password.
`database.mysql.table_prefix`	pureauth_	Table prefix: letters, digits and underscores.
`settings.language`	EN	PL selects PL_pl.txt; EN selects EN_en.txt. Other values fall back to EN.
`network.mode`	LOCAL	LOCAL for local state; REDIS for shared multi-proxy coordination. Does not enable synchronization by itself.
`network.sync.enabled`	false	Enables secure proxy/backend authentication synchronization; both sides need a valid secret.
`network.sync.shared_secret`	""	The same random secret on every proxy and backend; minimum 32 characters, recommended 64 hex characters from OpenSSL. See section 5.
`network.redis.host`	localhost	Redis host/IP shared by network modules.
`network.redis.port`	6379	Redis TCP port.
`network.redis.username`	""	Redis ACL username; empty uses the default user.
`network.redis.password`	""	Redis/ACL password, separate from the synchronization secret.
`network.redis.database`	0	Redis logical database index.
`network.redis.key_prefix`	pureauth:	Shared namespace for one network; use a distinct prefix for independent networks. A trailing colon is normalized.
`network.redis.connection_timeout_ms`	2000	Redis connection establishment limit, in milliseconds.
`network.redis.socket_timeout_ms`	2000	Redis reply timeout, in milliseconds.
`network.redis.player_lock_ttl_seconds`	45	Username reservation validity, in seconds; minimum 10, normally renewed about every TTL/3.
`network.redis.authenticated_ttl_seconds`	600	Shared authentication-state validity; does not replace synchronization settings.
`network.redis.failure_policy`	DENY	DENY rejects unprotected connections; ALLOW permits local fallback without multi-proxy guarantees.

27.2 Velocity

Path	Default	Meaning
`database.driver`	MYSQL	Velocity storage type; choose MYSQL for a network.
`database.pool.maximum_pool_size`	16	Maximum database connections; -1 selects Paper defaults (SQLite 1, MySQL 16). Proxy default: 16.
`database.pool.minimum_idle`	4	Minimum idle connections; -1 selects automatically. Proxy default: 4.
`database.pool.connection_timeout_ms`	10000	Maximum wait for a pooled database connection, in milliseconds.
`database.pool.idle_timeout_ms`	600000	Idle duration before surplus connections may close, in milliseconds.
`database.pool.max_lifetime_ms`	1800000	Maximum connection age, in milliseconds; keep compatible with SQL server limits.
`database.host`	localhost	MySQL/MariaDB host/IP.
`database.port`	3306	MySQL/MariaDB port.
`database.database`	pureauth	SQL schema name, identical across the network.
`database.username`	root	Dedicated database user.
`database.password`	""	SQL user password.
`database.prefix`	pureauth_	Velocity table prefix, matching table_prefix on other modules.
`settings.language`	EN	PL selects PL_pl.txt; EN selects EN_en.txt. Other values fall back to EN.
`network.mode`	LOCAL	LOCAL for local state; REDIS for shared multi-proxy coordination. Does not enable synchronization by itself.
`network.sync.enabled`	false	Enables secure proxy/backend authentication synchronization; both sides need a valid secret.
`network.sync.shared_secret`	""	The same random secret on every proxy and backend; minimum 32 characters, recommended 64 hex characters from OpenSSL. See section 5.
`network.redis.host`	localhost	Redis host/IP shared by network modules.
`network.redis.port`	6379	Redis TCP port.
`network.redis.username`	""	Redis ACL username; empty uses the default user.
`network.redis.password`	""	Redis/ACL password, separate from the synchronization secret.
`network.redis.database`	0	Redis logical database index.
`network.redis.key_prefix`	pureauth:	Shared namespace for one network; use a distinct prefix for independent networks. A trailing colon is normalized.
`network.redis.connection_timeout_ms`	2000	Redis connection establishment limit, in milliseconds.
`network.redis.socket_timeout_ms`	2000	Redis reply timeout, in milliseconds.
`network.redis.player_lock_ttl_seconds`	45	Username reservation validity, in seconds; minimum 10, normally renewed about every TTL/3.
`network.redis.authenticated_ttl_seconds`	600	Shared authentication-state validity; does not replace synchronization settings.
`network.redis.failure_policy`	DENY	DENY rejects unprotected connections; ALLOW permits local fallback without multi-proxy guarantees.

28. Complete message index

These defaults apply to a fresh installation in the selected language. Your customized files may differ. Keep YAML lists as lists; semicolons in this table separate list items. A key being present does not mean every installation displays it in every flow.

Paper

Key	Default text	Variables
`prefix`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh &8» &7	—
`join_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`join_subtitle_register`	&fType /register <pass> <pass> <captcha>	—
`join_subtitle_login`	&fType /login <pass>	—
`actionbar_timer`	&7Time remaining: &c%time%s	`%time%`
`captcha_message`	&eCaptcha Code: &6&l%code%	`%code%`
`reminder_register`	&7Please register: &b/register <pass> <pass> %code%	`%code%`
`reminder_login`	&7Please login using &b/login <password>	—
`title_locked`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_locked`	&cAccount has been blocked	—
`error_locked_chat`	&cAccount has been blocked! Too many login attempts, please contact the administration to unblock your account.	—
`temporary_lock_title`	&c&lLOGIN BLOCKED	—
`temporary_lock_subtitle`	&7Try again in &f%time%	`%time%`
`temporary_lock_chat`	&cLogin is blocked for &f%time% &cbecause of too many failed attempts.	`%time%`
`temporary_lock_actionbar`	&cLogin blocked: &f%time%	`%time%`
`temporary_lock_kick`	&cToo many failed attempts. Login blocked for %time%.	`%time%`
`temporary_lock_expired`	&aThe temporary login block has expired. You can log in now.	—
`permanent_lock_kick`	&cToo many failed attempts. Your account has been permanently blocked.	—
`lock_database_error_kick`	&cCould not safely save the login penalty. Please reconnect or contact the administration.	—
`success_register`	&aSuccessfully registered!	—
`success_login`	&aSuccessfully logged in!	—
`success_premium_login`	&bPremium Auto-Login successful! (IP Verified)	—
`success_session`	&aSession restored.	—
`password_changed`	&aYour password has been changed.	—
`pin_login_open`	&7Enter your PIN in the secure window.	—
`pin_login_reminder`	&7Complete PIN authentication in the open window.	—
`pin_setup_open`	&7Enter your new PIN, then enter it again.	—
`pin_change_open`	&7Enter your current PIN, followed by your new PIN twice.	—
`pin_confirm_prompt`	&eEnter the same PIN again to confirm.	—
`pin_mismatch`	&cPINs did not match. Start again.	—
`pin_current_success`	&aCurrent PIN accepted. Enter a new PIN.	—
`pin_current_wrong`	&cCurrent PIN is incorrect. Try again.	—
`pin_login_success`	&aPIN accepted.	—
`pin_saved`	&aYour PIN has been saved securely.	—
`pin_removed`	&aPIN login disabled. You will use your password again.	—
`pin_not_set`	&cYou do not have a PIN set.	—
`pin_already_set`	&cYou already have a PIN. Use /changepass to change it.	—
`pin_disabled`	&cPIN authentication is disabled by the server administrator.	—
`pin_invalid`	&cPIN must contain exactly %length% digits.	`%length%`
`pin_database_error`	&cThe PIN could not be saved. Please try again or contact an administrator.	—
`database_error`	&cThe account data could not be saved. Please try again or contact an administrator.	—
`pin_gui_cancelled`	&ePIN operation cancelled.	—
`pin_command_no_args`	&cThis command does not accept arguments.	—
`pin_login_command_blocked`	&c/login is disabled for this account. Use the PIN window.	—
`pin_changepass_gui_only`	&cYour account uses a PIN. Run /changepass without arguments.	—
`pin_admin_changed_notice`	&eAn administrator changed your PIN settings. The change applies to your next login.	—
`pin_admin_rejoin`	&eAn administrator changed your login method. Reconnect to continue safely.	—
`pin_halted_title`	&c&lLOGIN STOPPED	—
`pin_halted_subtitle`	&7Reconnect to try again.	—
`pin_halted_subtitle_recovery`	&7Reconnect or use /recovery start.	—
`pin_halted_chat`	&cPIN login was stopped because the window was closed. Reconnect to continue.	—
`pin_halted_chat_recovery`	&cPIN login was stopped. Reconnect, or use /recovery start and follow the recovery instructions.	—
`pin_gui_title`	&#54DAF4&lPureAuth &8\| &dPIN	—
`pin_gui_filler_name`		—
`pin_gui_input_filled_name`	&a&l●	—
`pin_gui_input_empty_name`	&8○	—
`pin_gui_status_login`	&b&lENTER PIN	—
`pin_gui_status_setup_new`	&a&lSET A NEW PIN	—
`pin_gui_status_setup_confirm`	&e&lCONFIRM YOUR PIN	—
`pin_gui_status_change_current`	&6&lENTER CURRENT PIN	—
`pin_gui_status_change_new`	&a&lENTER NEW PIN	—
`pin_gui_status_change_confirm`	&e&lCONFIRM NEW PIN	—
`pin_gui_status_complete`	&a&lCOMPLETE	—
`pin_gui_status_lore`	&7Click the number heads below.; &7The entry submits automatically.	—
`pin_gui_control_backspace_name`	&e&lBACKSPACE	—
`pin_gui_control_backspace_lore`	&7Remove the last digit.	—
`pin_gui_control_clear_name`	&c&lCLEAR	—
`pin_gui_control_clear_lore`	&7Clear all entered digits.	—
`pin_gui_digit_0_name`	&b&l0	—
`pin_gui_digit_0_lore`	&7Click to enter 0.	—
`pin_gui_digit_1_name`	&b&l1	—
`pin_gui_digit_1_lore`	&7Click to enter 1.	—
`pin_gui_digit_2_name`	&b&l2	—
`pin_gui_digit_2_lore`	&7Click to enter 2.	—
`pin_gui_digit_3_name`	&b&l3	—
`pin_gui_digit_3_lore`	&7Click to enter 3.	—
`pin_gui_digit_4_name`	&b&l4	—
`pin_gui_digit_4_lore`	&7Click to enter 4.	—
`pin_gui_digit_5_name`	&b&l5	—
`pin_gui_digit_5_lore`	&7Click to enter 5.	—
`pin_gui_digit_6_name`	&b&l6	—
`pin_gui_digit_6_lore`	&7Click to enter 6.	—
`pin_gui_digit_7_name`	&b&l7	—
`pin_gui_digit_7_lore`	&7Click to enter 7.	—
`pin_gui_digit_8_name`	&b&l8	—
`pin_gui_digit_8_lore`	&7Click to enter 8.	—
`pin_gui_digit_9_name`	&b&l9	—
`pin_gui_digit_9_lore`	&7Click to enter 9.	—
`title_success_register`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_register`	&aYou have been successfully registered.	—
`title_success_login`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_login`	&aYou have been successfully logged in.	—
`title_success_premium_login`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_premium_login`	&bPremium Auto-Login Successful.	—
`title_success_session`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_session`	&aSession Restored.	—
`2fa_usage`	&cUsage: /2fa <setup\|remove\|recovery>	—
`2fa_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`2fa_subtitle_setup`	&6VERIFICATION	—
`2fa_subtitle_login`	&6ENTER 2FA CODE	—
`2fa_setup_start`	&aGenerating 2FA Key... Please enter this key into Google Authenticator:	—
`2fa_key_msg`	&e&lKey: &b&l%key%	`%key%`
`2fa_enter_code`	&7Now type the &b6-digit code&7 from the app into the chat to confirm.	—
`2fa_setup_success`	&a2FA Setup Complete! Your account is now secured.	—
`2fa_setup_fail`	&cIncorrect code. 2FA setup cancelled.	—
`2fa_login_req`	&bTwo-Factor Authentication enabled. Please enter your app code.	—
`2fa_removed`	&cTwo-Factor Authentication has been disabled.	—
`2fa_verify_remove`	&7Please enter your 2FA code to confirm removal.	—
`2fa_not_enabled`	&cYou do not have 2FA enabled.	—
`2fa_already`	&cYou already have 2FA enabled. Use /2fa remove to disable it first.	—
`title_success_2fa`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_2fa`	&aCode Accepted.	—
`success_2fa_verify`	&a2FA Code Verified Successfully! Logging in...	—
`2fa_backup_codes_msg`	&c&lSAVE THESE BACKUP CODES! &7They can be used once to disable 2FA if you lose access: &f%codes%	`%codes%`
`2fa_recovery_usage`	&cUsage: /2fa recovery <code>	—
`2fa_recovery_success`	&a2FA has been disabled using a backup code. All previous backup codes are now invalid.	—
`2fa_recovery_fail`	&cInvalid backup code.	—
`recovery_questions`	What is your mother's maiden name?; What was the name of your first pet?; What is your favorite color?; What city were you born in?; What is your favorite food?	—
`recovery_setup_usage`	&cUsage: /recovery <setup\|remove\|start\|pass>	—
`recovery_remove_success`	&aRecovery questions removed from your account.	—
`recovery_question_list`	&ePlease select a security question by typing the number:	—
`recovery_question_format`	&b%number%. &f%question%	`%number%`, `%question%`
`recovery_answer_prompt`	&eType your answer for: &f%question%	`%question%`
`recovery_setup_success`	&aRecovery question set successfully! &7Encrypted and saved.	—
`recovery_start_usage`	&cUsage: /recovery start	—
`recovery_verify_success`	&aAnswer correct! You can now change your password.	—
`recovery_pass_usage`	&aUse: /recovery pass <new_pass> <new_pass>	—
`recovery_pass_changed`	&aPassword changed successfully! Logging you in...	—
`recovery_pin_removed`	&eYour forgotten PIN was removed. Future logins will use the new password.	—
`recovery_database_error`	&cRecovery could not save the new login details. Nothing was changed; please try again.	—
`recovery_not_set`	&cYou do not have recovery questions set up.	—
`recovery_already_setup`	&cRecovery is already set up. Use /recovery remove to reset.	—
`recovery_fail`	&cIncorrect answer.	—
`recovery_session_expired`	&cRecovery session expired.	—
`recovery_cancelled`	&cRecovery process cancelled.	—
`recovery_disabled`	&cRecovery system is disabled.	—
`recovery_invalid_number`	&cInvalid number. Try again or type cancel.	—
`recovery_number_required`	&cPlease type a number.	—
`recovery_question_config_error`	&cMessage configuration error: the saved recovery question no longer exists.	—
`recovery_verification_required`	&cYou must verify your recovery question first. Use /recovery start.	—
`sync_success`	&aSynced login from proxy.	—
`update_available`	&eA new update is available! (&c%current% &7-> &a%new%&e)	`%current%`, `%new%`
`update_download`	&eDownload at: &bhttps://modrinth.com/plugin/pureauth	—
`premium_enabled`	&aPremium Mode enabled! You will auto-login from this IP.	—
`premium_disabled`	&ePremium Mode disabled. Password required.	—
`premium_fail_api`	&cVerification failed. Are you using a real paid account?	—
`premium_already`	&cPremium mode is already enabled.	—
`premium_not_enabled`	&cYou are not in Premium mode.	—
`premium_ip_changed`	&cAuto-login disabled for this session because your IP changed.	—
`premium_disabled_admin`	&cPremium Auto-Login is currently disabled by the server administration.	—
`premium_api_error`	&cAPI error: %error%	`%error%`
`error_already_online`	&cThis username is already connected to the server!	—
`error_wrong_pass`	&7Incorrect password! &cAttempts: %attempts%/%max%	`%attempts%`, `%max%`
`error_usage_login`	&cUsage: /login <password>	—
`error_usage_changepass`	&cUsage: /changepass <old> <new> <new>	—
`error_vpn_kick`	&cVPN/Proxy connection detected. Please disable your VPN.	—
`error_wrong_captcha`	&cIncorrect captcha code! Please check chat.	—
`error_usage_captcha`	&cUsage: /register <pass> <pass> <captcha>	—
`error_usage_reg`	&cUsage: /register <pass> <pass>	—
`error_kick_attempts`	&cToo many failed attempts.	—
`error_kick_timeout`	&cLogin timed out.	—
`error_already_logged`	&cAlready logged in.	—
`error_not_logged`	&cYou must login first!	—
`error_match_pass`	&cPasswords do not match.	—
`error_length_pass`	&cPassword too short. Min: %length%	`%length%`
`error_already_reg`	&cAlready registered!	—
`error_not_reg`	&cNot registered!	—
`error_wrong_old`	&cOld password incorrect.	—
`error_max_ip`	&cMax accounts reached.	—
`error_launcher_mismatch`	&cYou cannot enable Premium Mode from a Non-Premium Launcher.	—
`online_mode_fail_safe_kick`	&cFAIL-SAFE: server.properties online-mode must be false!	—
`admin_guard_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`admin_guard_subtitle`	&c&lADMIN GUARD \| 2FA REQUIRED	—
`admin_guard_chat`	&c&l[Admin Guard] &fAdmin Guard has enforced Two-Factor Authentication on your account. You must set up 2FA to continue.	—
`admin_guard_forced_setup`	&eAdmin Guard: &7Follow the instructions below to configure 2FA on your administrator account.	—
`admin_guard_remove_warning`	&cAdmin Guard requires 2FA. You cannot disable it while this requirement applies.	—
`admin_reload`	&aConfiguration reloaded.	—
`admin_unregister`	&aUnregistered account for %player%.	`%player%`
`admin_loc_set`	&aSet %type% location to your position.	`%type%`
`admin_pass_set`	&aPassword set for %player%.	`%player%`
`admin_force_login`	&aForcefully logged in %player%.	`%player%`
`admin_unlock`	&aAccount unlocked for %player%.	`%player%`
`admin_register_success`	&aSuccessfully registered account for %player%.	`%player%`
`admin_register_fail`	&cPlayer %player% is already registered!	`%player%`
`admin_console_only`	&cThis command is console only.	—
`admin_safe_mode`	&cSAFE MODE ENABLED: This command is available from Console Only.	—
`admin_player_not_found`	&cPlayer not found in database.	—
`admin_unknown_command`	&cUnknown command. Type /pureauth for help.	—
`admin_help`	&eAvailable: reload, unregister, register, location, forcelogin, unlock, info, setpassword, setpin, changepin, rempin, accounts, stats	—
`admin_pin_set`	&aPIN set for %player%.	`%player%`
`admin_pin_changed`	&aPIN changed for %player%.	`%player%`
`admin_pin_removed`	&aPIN removed for %player%.	`%player%`
`admin_pin_already_set`	&c%player% already has a PIN. Use changepin.	`%player%`
`admin_pin_not_set`	&c%player% does not have a PIN.	`%player%`
`admin_no_perm`	&cNo permission.	—
`admin_players_only`	&cPlayers only.	—
`admin_invalid_type`	&cInvalid type.	—
`admin_offline`	&cPlayer offline.	—
`admin_header_border`	&8&m---------------------------------------	—
`admin_info_header`	&8&m---&r &b%player% &8&m---	`%player%`
`admin_info_body`	&7UUID: &f%uuid% &7IP: &f%ip% &7Last Login: &f%last_login% &7Registered: &f%registered% &7Premium: &f%premium% &7PIN Enabled: &f%pin_enabled% &7Locked: &f%locked% &7Temporary Lock Until: &f%temporary_lock_until% &7Failed Login Kicks: &f%failed_login_kicks% &7Recovery Set: &f%recovery_set% &72FA Enabled: &f%2fa_enabled%	`%2fa_enabled%`, `%failed_login_kicks%`, `%ip%`, `%last_login%`, `%locked%`, `%pin_enabled%`, `%premium%`, `%recovery_set%`, `%registered%`, `%temporary_lock_until%`, `%uuid%`
`admin_accounts`	&eAccounts: &f%accounts%	`%accounts%`
`admin_version`	&b&lPureAuth &7v%version%	`%version%`
`admin_created_by`	&7Created by: &fSzymeX Dev Studio	—
`admin_stats_title`	&b&lPureAuth Stats (v%version%)	`%version%`
`admin_stats_users`	&7Users: &f%count%	`%count%`
`admin_stats_safe_mode`	&7Safe Mode: &f%value%	`%value%`
`admin_stats_discord`	&7Discord: &f%value%	`%value%`
`admin_stats_backup`	&7Backup: &f%value%	`%value%`
`admin_unlock_kick`	&aAccount unlocked for %player%. &fPlease rejoin to login.	`%player%`
`admin_unregister_kick`	&aUnregistered account for %player%. &fPlease rejoin to register again.	`%player%`
`location_login_name`	Login	—
`location_register_name`	Register	—
`admin_usage_unlock`	&cUsage: /pureauth unlock <player>	—
`admin_usage_unregister`	&cUsage: /pureauth unregister <player>	—
`admin_usage_register`	&cUsage: /pureauth register <player> <password>	—
`admin_usage_forcelogin`	&cUsage: /pureauth forcelogin <player>	—
`admin_usage_info`	&cUsage: /pureauth info <player>	—
`admin_usage_setpassword`	&cUsage: /pureauth setpassword <player> <newpass>	—
`admin_usage_accounts`	&cUsage: /pureauth accounts <IP>	—
`admin_usage_location`	&cUsage: /pureauth location <login\|register>	—
`admin_usage_setpin`	&cUsage: /pureauth setpin <player> <pin>	—
`admin_usage_changepin`	&cUsage: /pureauth changepin <player> <pin>	—
`admin_usage_rempin`	&cUsage: /pureauth rempin <player>	—
`fair_play_disabled`	&cFair Play Guard is disabled in config.yml.	—
`fair_play_setup_start`	&eStand at the inspection location, then use &f/pureauth check setup confirm&e.	—
`fair_play_setup_title`	&#54DAF4&lPureAuth	—
`fair_play_setup_subtitle`	&eStand at the inspection location	—
`fair_play_setup_not_started`	&cStart setup first with /pureauth check setup.	—
`fair_play_setup_saved`	&aFair Play Guard inspection location saved.	—
`fair_play_location_missing`	&cThe inspection location is not configured. Use /pureauth check setup.	—
`fair_play_usage`	&cUsage: /pureauth check <player>\|setup\|clear <player>	—
`fair_play_target_offline`	&cThat player is not online.	—
`fair_play_target_not_authenticated`	&cThe player must authenticate before an inspection can start.	—
`fair_play_already_checked`	&cThat player is already being inspected.	—
`fair_play_started_admin`	&aStarted a Fair Play Guard inspection for %player%.	`%player%`
`fair_play_started_player`	&eYou are being inspected by %admin%. Follow the instructions below.	`%admin%`
`fair_play_title`	&#54DAF4&lPureAuth	—
`fair_play_subtitle`	&eFAIR PLAY INSPECTION	—
`fair_play_reminder`	&eYou are being checked for prohibited modifications. Join &b%discord% &eand enter the designated waiting area. Inspector: &f%admin%	`%admin%`, `%discord%`
`fair_play_private_chat_format`	&8[Fair Play Guard] &f%player% &8» &7%message%	`%message%`, `%player%`
`fair_play_command_blocked`	&cCommands are disabled while you are being checked.	—
`fair_play_returned_to_area`	&eYou moved too far from the inspection area and were returned.	—
`fair_play_clear_not_found`	&cNo active or persistent Fair Play Guard restriction was found for %player%.	`%player%`
`fair_play_cleared_admin`	&a%player% was cleared and no prohibited modifications were found.	`%player%`
`fair_play_cleared_player`	&aThe inspection is complete. No prohibited modifications were found.	—
`fair_play_clear_title`	&#54DAF4&lPureAuth	—
`fair_play_clear_subtitle`	&aINSPECTION CLEARED	—
`fair_play_disconnect_reason`	Disconnected during a Fair Play Guard inspection	—
`fair_play_disconnect_locked`	&cThe account of %player% was blocked because the player disconnected during an inspection.	`%player%`
`fair_play_lock_kick`	&#54DAF4&lPureAuth &cYour account is blocked because you disconnected during a Fair Play Guard inspection. &7To appeal this restriction, contact the server administration.	—
`fair_play_database_error`	&cFair Play Guard could not safely save the restriction. Check the console and database connection.	—
`fair_play_ban_cleanup`	&7Fair Play Guard released %player% because a server ban was detected.	`%player%`
`network_duplicate_kick`	&#54DAF4&lPureAuth &cThis username is already connected elsewhere on the network.	—
`network_unavailable_kick`	&#54DAF4&lPureAuth &cThe authentication network is temporarily unavailable. Please try again shortly.	—
`sync_configuration_invalid`	&cProxy synchronization disabled: configure a shared random secret (at least 32 characters).	—
`sync_rejected`	&cInvalid or outdated synchronization rejected. Please log in normally.	—
`authentication_changed`	&cYour account security settings changed. Please authenticate again.	—
`sessions_revoked`	&cPrevious sessions were revoked after a security change. Please log in again.	—
`password_too_long`	&cThe value must not exceed 72 UTF-8 bytes.	—
`startup_unavailable`	&cAuthentication is unavailable. An administrator must check configuration and database connectivity.	—
`admin_reload_failed`	&cConfiguration or message reload failed. Check YAML syntax and the console; previous valid messages remain active.	—
`authentication_wait`	&ePlease wait for your previous request to finish, then try again.	—
`authentication_busy`	&cAuthentication is busy. Please reconnect shortly.	—

BungeeCord and Velocity

Both proxies have the same default key set below. network_duplicate_kick and network_unavailable_kick are particularly relevant to current network operation. Other retained texts do not add Paper commands or features to a proxy. Edit Paper text on the backend.

Key	Default text	Variables
`prefix`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh &8» &7	—
`join_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`join_subtitle_register`	&fType /register <pass> <pass> <captcha>	—
`join_subtitle_login`	&fType /login <pass>	—
`actionbar_timer`	&7Time remaining: &c%time%s	`%time%`
`captcha_message`	&eCaptcha Code: &6&l%code%	`%code%`
`reminder_register`	&7Please register: &b/register <pass> <pass> %code%	`%code%`
`reminder_login`	&7Please login using &b/login <password>	—
`title_locked`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_locked`	&cAccount has been blocked	—
`error_locked_chat`	&cAccount has been blocked! Too many login attempts, please contact the administration to unblock your account.	—
`temporary_lock_title`	&c&lLOGIN BLOCKED	—
`temporary_lock_subtitle`	&7Try again in &f%time%	`%time%`
`temporary_lock_chat`	&cLogin is blocked for &f%time% &cbecause of too many failed attempts.	`%time%`
`temporary_lock_actionbar`	&cLogin blocked: &f%time%	`%time%`
`temporary_lock_kick`	&cToo many failed attempts. Login blocked for %time%.	`%time%`
`temporary_lock_expired`	&aThe temporary login block has expired. You can log in now.	—
`permanent_lock_kick`	&cToo many failed attempts. Your account has been permanently blocked.	—
`lock_database_error_kick`	&cCould not safely save the login penalty. Please reconnect or contact the administration.	—
`success_register`	&aSuccessfully registered!	—
`success_login`	&aSuccessfully logged in!	—
`success_premium_login`	&bPremium Auto-Login successful! (IP Verified)	—
`success_session`	&aSession restored.	—
`password_changed`	&aYour password has been changed.	—
`pin_login_open`	&7Enter your PIN in the secure window.	—
`pin_login_reminder`	&7Complete PIN authentication in the open window.	—
`pin_setup_open`	&7Enter your new PIN, then enter it again.	—
`pin_change_open`	&7Enter your current PIN, followed by your new PIN twice.	—
`pin_confirm_prompt`	&eEnter the same PIN again to confirm.	—
`pin_mismatch`	&cPINs did not match. Start again.	—
`pin_current_success`	&aCurrent PIN accepted. Enter a new PIN.	—
`pin_current_wrong`	&cCurrent PIN is incorrect. Try again.	—
`pin_login_success`	&aPIN accepted.	—
`pin_saved`	&aYour PIN has been saved securely.	—
`pin_removed`	&aPIN login disabled. You will use your password again.	—
`pin_not_set`	&cYou do not have a PIN set.	—
`pin_already_set`	&cYou already have a PIN. Use /changepass to change it.	—
`pin_disabled`	&cPIN authentication is disabled by the server administrator.	—
`pin_invalid`	&cPIN must contain exactly %length% digits.	`%length%`
`pin_database_error`	&cThe PIN could not be saved. Please try again or contact an administrator.	—
`database_error`	&cThe account data could not be saved. Please try again or contact an administrator.	—
`pin_gui_cancelled`	&ePIN operation cancelled.	—
`pin_command_no_args`	&cThis command does not accept arguments.	—
`pin_login_command_blocked`	&c/login is disabled for this account. Use the PIN window.	—
`pin_changepass_gui_only`	&cYour account uses a PIN. Run /changepass without arguments.	—
`pin_admin_changed_notice`	&eAn administrator changed your PIN settings. The change applies to your next login.	—
`pin_admin_rejoin`	&eAn administrator changed your login method. Reconnect to continue safely.	—
`pin_halted_title`	&c&lLOGIN STOPPED	—
`pin_halted_subtitle`	&7Reconnect to try again.	—
`pin_halted_subtitle_recovery`	&7Reconnect or use /recovery start.	—
`pin_halted_chat`	&cPIN login was stopped because the window was closed. Reconnect to continue.	—
`pin_halted_chat_recovery`	&cPIN login was stopped. Reconnect, or use /recovery start and follow the recovery instructions.	—
`title_success_register`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_register`	&aYou have been successfully registered.	—
`title_success_login`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_login`	&aYou have been successfully logged in.	—
`title_success_premium_login`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_premium_login`	&bPremium Auto-Login Successful.	—
`title_success_session`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_session`	&aSession Restored.	—
`2fa_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`2fa_subtitle_setup`	&6VERIFICATION	—
`2fa_subtitle_login`	&6ENTER 2FA CODE	—
`2fa_setup_start`	&aGenerating 2FA Key... Please enter this key into Google Authenticator:	—
`2fa_key_msg`	&e&lKey: &b&l%key%	`%key%`
`2fa_enter_code`	&7Now type the &b6-digit code&7 from the app into the chat to confirm.	—
`2fa_setup_success`	&a2FA Setup Complete! Your account is now secured.	—
`2fa_setup_fail`	&cIncorrect code. 2FA setup cancelled.	—
`2fa_login_req`	&bTwo-Factor Authentication enabled. Please enter your app code.	—
`2fa_removed`	&cTwo-Factor Authentication has been disabled.	—
`2fa_verify_remove`	&7Please enter your 2FA code to confirm removal.	—
`2fa_not_enabled`	&cYou do not have 2FA enabled.	—
`2fa_already`	&cYou already have 2FA enabled. Use /2fa remove to disable it first.	—
`title_success_2fa`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`subtitle_success_2fa`	&aCode Accepted.	—
`success_2fa_verify`	&a2FA Code Verified Successfully! Logging in...	—
`2fa_backup_codes_msg`	&c&lSAVE THESE BACKUP CODES! &7They can be used once to disable 2FA if you lose access: &f%codes%	`%codes%`
`2fa_recovery_usage`	&cUsage: /2fa recovery <code>	—
`2fa_recovery_success`	&a2FA has been disabled using a backup code. All previous backup codes are now invalid.	—
`2fa_recovery_fail`	&cInvalid backup code.	—
`recovery_setup_usage`	&cUsage: /recovery <setup\|remove\|start\|pass>	—
`recovery_remove_success`	&aRecovery questions removed from your account.	—
`recovery_question_list`	&ePlease select a security question by typing the number:	—
`recovery_answer_prompt`	&eType your answer for: &f%question%	`%question%`
`recovery_setup_success`	&aRecovery question set successfully! &7Encrypted and saved.	—
`recovery_start_usage`	&cUsage: /recovery start	—
`recovery_verify_success`	&aAnswer correct! You can now change your password.	—
`recovery_pass_usage`	&aUse: /recovery pass <new_pass> <new_pass>	—
`recovery_pass_changed`	&aPassword changed successfully! Logging you in...	—
`recovery_pin_removed`	&eYour forgotten PIN was removed. Future logins will use the new password.	—
`recovery_database_error`	&cRecovery could not save the new login details. Nothing was changed; please try again.	—
`recovery_not_set`	&cYou do not have recovery questions set up.	—
`recovery_already_setup`	&cRecovery is already set up. Use /recovery remove to reset.	—
`recovery_fail`	&cIncorrect answer.	—
`recovery_session_expired`	&cRecovery session expired.	—
`recovery_cancelled`	&cRecovery process cancelled.	—
`recovery_disabled`	&cRecovery system is disabled.	—
`sync_success`	&aSynced login from proxy.	—
`update_available`	&eA new update is available! (&c%current% &7-> &a%new%&e)	`%current%`, `%new%`
`update_download`	&eDownload at: &bhttps://modrinth.com/plugin/pureauth	—
`premium_enabled`	&aPremium Mode enabled! You will auto-login from this IP.	—
`premium_disabled`	&ePremium Mode disabled. Password required.	—
`premium_fail_api`	&cVerification failed. Are you using a real paid account?	—
`premium_already`	&cPremium mode is already enabled.	—
`premium_not_enabled`	&cYou are not in Premium mode.	—
`premium_ip_changed`	&cAuto-login disabled for this session because your IP changed.	—
`premium_disabled_admin`	&cPremium Auto-Login is currently disabled by the server administration.	—
`error_already_online`	&cThis username is already connected to the server!	—
`error_wrong_pass`	&7Incorrect password! &cAttempts: %attempts%/%max%	`%attempts%`, `%max%`
`error_usage_login`	&cUsage: /login <password>	—
`error_usage_changepass`	&cUsage: /changepass <old> <new> <new>	—
`error_vpn_kick`	&cVPN/Proxy connection detected. Please disable your VPN.	—
`error_wrong_captcha`	&cIncorrect captcha code! Please check chat.	—
`error_usage_captcha`	&cUsage: /register <pass> <pass> <captcha>	—
`error_usage_reg`	&cUsage: /register <pass> <pass>	—
`error_kick_attempts`	&cToo many failed attempts.	—
`error_kick_timeout`	&cLogin timed out.	—
`error_already_logged`	&cAlready logged in.	—
`error_not_logged`	&cYou must login first!	—
`error_match_pass`	&cPasswords do not match.	—
`error_length_pass`	&cPassword too short. Min: %length%	`%length%`
`error_already_reg`	&cAlready registered!	—
`error_not_reg`	&cNot registered!	—
`error_wrong_old`	&cOld password incorrect.	—
`error_max_ip`	&cMax accounts reached.	—
`error_launcher_mismatch`	&cYou cannot enable Premium Mode from a Non-Premium Launcher.	—
`admin_guard_title`	&#54DAF4&l&nP &#5BBBF6&l&nu &#629CF7&l&nr &#697DF9&l&ne &#6F5DFA&l&nA &#763EFC&l&nu &#7D1FFD&l&nt &#8400FF&l&nh	—
`admin_guard_subtitle`	&c&lADMIN GUARD \| 2FA REQUIRED	—
`admin_guard_chat`	&c&l[Admin Guard] &fAdmin Guard has enforced Two-Factor Authentication on your account. You must set up 2FA to continue.	—
`admin_guard_forced_setup`	&eAdmin Guard: &7Follow the instructions below to configure 2FA on your administrator account.	—
`admin_guard_remove_warning`	&c&l[Admin Guard] &7Warning: You have the Admin Guard permission. You will be required to re-enable 2FA on your next login.	—
`admin_reload`	&aConfiguration reloaded.	—
`admin_unregister`	&aUnregistered account for %player%.	`%player%`
`admin_loc_set`	&aSet %type% location to your position.	`%type%`
`admin_pass_set`	&aPassword set for %player%.	`%player%`
`admin_force_login`	&aForcefully logged in %player%.	`%player%`
`admin_unlock`	&aAccount unlocked for %player%.	`%player%`
`admin_register_success`	&aSuccessfully registered account for %player%.	`%player%`
`admin_register_fail`	&cPlayer %player% is already registered!	`%player%`
`admin_console_only`	&cThis command is console only.	—
`admin_safe_mode`	&cSAFE MODE ENABLED: This command is available from Console Only.	—
`admin_player_not_found`	&cPlayer not found in database.	—
`admin_unknown_command`	&cUnknown command. Type /pureauth for help.	—
`admin_help`	&eAvailable: reload, unregister, register, location, forcelogin, unlock, info, setpassword, setpin, changepin, rempin, accounts, stats	—
`admin_pin_set`	&aPIN set for %player%.	`%player%`
`admin_pin_changed`	&aPIN changed for %player%.	`%player%`
`admin_pin_removed`	&aPIN removed for %player%.	`%player%`
`admin_pin_already_set`	&c%player% already has a PIN. Use changepin.	`%player%`
`admin_pin_not_set`	&c%player% does not have a PIN.	`%player%`
`admin_no_perm`	&cNo permission.	—
`admin_players_only`	&cPlayers only.	—
`admin_invalid_type`	&cInvalid type.	—
`admin_offline`	&cPlayer offline.	—
`admin_header_border`	&8&m---------------------------------------	—
`admin_info_header`	&8&m---&r &b%player% &8&m---	`%player%`
`admin_usage_unlock`	&cUsage: /pureauth unlock <player>	—
`admin_usage_unregister`	&cUsage: /pureauth unregister <player>	—
`admin_usage_register`	&cUsage: /pureauth register <player> <password>	—
`admin_usage_forcelogin`	&cUsage: /pureauth forcelogin <player>	—
`admin_usage_info`	&cUsage: /pureauth info <player>	—
`admin_usage_setpassword`	&cUsage: /pureauth setpassword <player> <newpass>	—
`admin_usage_accounts`	&cUsage: /pureauth accounts <IP>	—
`admin_usage_location`	&cUsage: /pureauth location <login\|register>	—
`admin_usage_setpin`	&cUsage: /pureauth setpin <player> <pin>	—
`admin_usage_changepin`	&cUsage: /pureauth changepin <player> <pin>	—
`admin_usage_rempin`	&cUsage: /pureauth rempin <player>	—
`fair_play_disabled`	&cFair Play Guard is disabled in config.yml.	—
`fair_play_setup_start`	&eStand at the inspection location, then use &f/pureauth check setup confirm&e.	—
`fair_play_setup_title`	&#54DAF4&lPureAuth	—
`fair_play_setup_subtitle`	&eStand at the inspection location	—
`fair_play_setup_not_started`	&cStart setup first with /pureauth check setup.	—
`fair_play_setup_saved`	&aFair Play Guard inspection location saved.	—
`fair_play_location_missing`	&cThe inspection location is not configured. Use /pureauth check setup.	—
`fair_play_usage`	&cUsage: /pureauth check <player>\|setup\|clear <player>	—
`fair_play_target_offline`	&cThat player is not online.	—
`fair_play_target_not_authenticated`	&cThe player must authenticate before an inspection can start.	—
`fair_play_already_checked`	&cThat player is already being inspected.	—
`fair_play_started_admin`	&aStarted a Fair Play Guard inspection for %player%.	`%player%`
`fair_play_started_player`	&eYou are being inspected by %admin%. Follow the instructions below.	`%admin%`
`fair_play_title`	&#54DAF4&lPureAuth	—
`fair_play_subtitle`	&eFAIR PLAY INSPECTION	—
`fair_play_reminder`	&eYou are being checked for prohibited modifications. Join &b%discord% &eand enter the designated waiting area. Inspector: &f%admin%	`%admin%`, `%discord%`
`fair_play_private_chat_format`	&8[Fair Play Guard] &f%player% &8» &7%message%	`%message%`, `%player%`
`fair_play_command_blocked`	&cCommands are disabled while you are being checked.	—
`fair_play_returned_to_area`	&eYou moved too far from the inspection area and were returned.	—
`fair_play_clear_not_found`	&cNo active or persistent Fair Play Guard restriction was found for %player%.	`%player%`
`fair_play_cleared_admin`	&a%player% was cleared and no prohibited modifications were found.	`%player%`
`fair_play_cleared_player`	&aThe inspection is complete. No prohibited modifications were found.	—
`fair_play_clear_title`	&#54DAF4&lPureAuth	—
`fair_play_clear_subtitle`	&aINSPECTION CLEARED	—
`fair_play_disconnect_reason`	Disconnected during a Fair Play Guard inspection	—
`fair_play_disconnect_locked`	&cThe account of %player% was blocked because the player disconnected during an inspection.	`%player%`
`fair_play_lock_kick`	&#54DAF4&lPureAuth &cYour account is blocked because you disconnected during a Fair Play Guard inspection. &7To appeal this restriction, contact the server administration.	—
`fair_play_database_error`	&cFair Play Guard could not safely save the restriction. Check the console and database connection.	—
`fair_play_ban_cleanup`	&7Fair Play Guard released %player% because a server ban was detected.	`%player%`
`network_duplicate_kick`	&#54DAF4&lPureAuth &cThis username is already connected elsewhere on the network.	—
`network_unavailable_kick`	&#54DAF4&lPureAuth &cThe authentication network is temporarily unavailable. Please try again shortly.	—