Screenshot 1 of 1. MinecraftHub-generated cover art for VeloAuth: a floating snowy block island with server racks and a stone tower, under a night sky
What VeloAuth works with.
| Platform | Java Edition |
|---|---|
| Loaders | Velocity |
| Minecraft versions | 1.8, 1.16.5, 1.17.1, 1.18.2, 1.19.4, 1.20.6, 1.21.11, 26.1.2, 26.2, 26.3 |
VeloAuth is a Velocity authentication plugin. It handles login and registration at the proxy, before players reach any backend server. It installs on Velocity only, and players need nothing extra to join.
Server software and versions
- Velocity: Minecraft 1.8 to 26.3. The newest build needs no dependencies.
What VeloAuth does
One plugin covers premium and offline-mode players, so authentication lives in one place instead of on every backend.
- Premium auto-login. Premium players skip the password once their session is verified. Letting them pass through auth and limbo is a separate opt-in.
- Offline registration. Passwords are hashed with BCrypt, brute-force protection is built in, and the database enforces atomic first-owner registration.
- Nickname protection. Premium nicknames are reserved for their owners, and a renamed premium profile is detected and updated in the database.
- Optional TOTP two-factor login, compatible with Google Authenticator, Authy and Aegis.
- Forced hosts support, so players arriving on a custom domain are routed to their intended server after authentication.
- /login and /register are hidden while authorization is active and reappear when a session expires.
Installing and choosing a profile
Place the plugin file in the plugins folder of your Velocity proxy and restart it. Nickname strictness is set in plugins/veloauth/config.yml through the premium section, and the page describes these profiles.
- Mixed strict (default). Premium players auto-login, offline players register, and premium nicknames stay reserved.
- Offline-only. Set check-enabled to false: no lookups go to Mojang or Ashcon, premium auto-login is off, and the first player to register a nickname owns it.
Database, limbo and add-ons
Storage runs on MySQL, PostgreSQL, H2 or SQLite with HikariCP pooling. Existing LimboAuth databases are schema compatible and are migrated in place. Waiting players can sit in the optional built-in limbo, which uses a checksum-pinned ViaVersion runtime, or in an external limbo such as NanoLimbo. With Floodgate installed, Bedrock players are detected before Mojang resolution, and only UUIDs Floodgate confirms can bypass the auth server.
Premium status comes from a bounded three-layer cache (memory, database, then Mojang or Ashcon), and the plugin uses virtual threads on Java 21 so Velocity event loops are not blocked. Discord webhooks can report security anomalies, and 17 interface languages are included.
Questions about VeloAuth.
4 questions
How do I install VeloAuth?
Put the plugin file in the plugins folder of your Velocity proxy and restart the proxy. It is not installed on backend servers, and players do not install anything. Adjust the premium section of plugins/veloauth/config.yml to choose how strict nickname protection should be.
Does VeloAuth work with Floodgate?
Yes, Floodgate support is optional. Bedrock and linked Floodgate players are detected before Mojang resolution, and only UUIDs that Floodgate confirms can bypass the auth server. Without Floodgate installed, the plugin still runs normally for Java players.
Can I migrate from LimboAuth to VeloAuth?
VeloAuth uses a database schema compatible with LimboAuth and upgrades it in place with additive migrations. Existing data is therefore kept rather than rebuilt, which makes switching a matter of installing the plugin and pointing it at the same database.
Which databases does VeloAuth support?
It supports MySQL, PostgreSQL, H2 and SQLite, with HikariCP connection pooling. Registration ownership is enforced by the database itself, which prevents two players from claiming the same nickname at the same moment.
