> For the complete documentation index, see [llms.txt](https://impoo.gitbook.io/authenticationsystem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://impoo.gitbook.io/authenticationsystem/authentication.md).

# Authentication

This page explains the player registration and login flow in plain English.

## First join (registration)

When a player joins the server for the first time:

1. The player is marked as **unauthenticated**
2. They can only run `/register <password> <confirmPassword>`
3. All other commands and chat are blocked
4. They have **60 seconds** (by default) to register before being kicked

To register:

```
/register MySecurePass MySecurePass
```

The password must be entered twice to confirm. Passwords are hashed with **BCrypt cost 12** before being stored — they are never saved in plain text.

## Subsequent joins (login)

When a registered player joins:

1. The player is marked as **unauthenticated**
2. They can only run `/login <password>`
3. All other commands and chat are blocked
4. They have **60 seconds** (by default) to log in before being kicked

To log in:

```
/login MySecurePass
```

## Premium players

Premium players (with a valid Mojang account) are detected automatically:

1. On join, the player receives a premium confirmation prompt
2. They must confirm within **10 seconds** (double-click style)
3. Once confirmed, they are authenticated without needing a password
4. If they do not confirm, they must log in or register normally

Run `/premium` to manage your premium status.

## Changing password

A logged-in player can change their password:

```
/changepassword oldPassword newPassword
```

The old password is verified before the new one is saved.

## Authentication states

| State           | Meaning                                                     |
| --------------- | ----------------------------------------------------------- |
| Unauthenticated | Player has not registered or logged in yet                  |
| Waiting auth    | Player is in the process of authenticating (timeout active) |
| Authenticated   | Player is fully authenticated and can play normally         |
| Premium         | Player is a verified premium account                        |

## Timeout

If a player does not complete registration or login within `auth.timeout-seconds` (default: 60 seconds), they are kicked from the server. They can rejoin and try again.

***

> :bulb: **Tip**: Encourage your players to use strong passwords. AuthSystem hashes them securely, but a weak password is still easy to guess.