Lambda API

Official API for the Lambda utility mod

Routes

Statuses:

• ✅ Supported
• 🟡 Deprecated; To be removed soon
• ❌ Unsupported; Not working anymore
• ⏳ Not supported yet

Route	Method	Status	Information
/login	POST	✅	Allows a player to authenticate using a Minecraft username and Mojang session hash.
/link/discord	POST	✅	Links a Discord account to an existing authentication token using a Discord OAuth token.
/party/create	POST	❌	Creates a new party and associates it with the player. Automatically deletes or leaves existing parties for the player.
/party/join	PUT	❌	Allows a player to join an existing party using a party secret.
/party/leave	PUT	❌	Removes a player from their current party. Deletes the party if the player is the leader.
/party/delete	DELETE	❌	Deletes an existing party if the player is the leader.
/party	GET	❌	Retrieves details about the player's current party.
/party/listen	GET	❌	Streams party updates to the player via Server-Sent Events (SSE).
/cape	GET	✅	Fetches the ID of a player's cape
/cape	PUT	✅	Updates the player's cape with a new ID.
/capes	GET	✅	Retrieves cape ids from a list of players

Authentication

We understand that not all players trust us to handle account tokens, especially Microsoft ones.
This is why we've decided to use a unique authentication method that ensure security and anonymity

How does it work ?

This system authenticates players by verifying their session with Mojang's servers, ensuring they own the Minecraft account they claim to. It is only effective in online-mode servers—offline servers cannot be trusted for this verification.

1. Server sends RSA public key → Client generates AES-128 secret key and SHA-1 session hash (secret + server key).
2. Encrypted handshake with server's public key and client's secret to prevents MITM attacks.
3. Client posts hash to Mojang (https://sessionserver.mojang.com/session/minecraft/join), valid for 5 minutes to prevent replay attacks