Authentication

Pumpkin verifies accounts with Mojang's session servers to ensure players use legitimate accounts. Authentication settings are configured under [networking.java.authentication] and [networking.bedrock.authentication] in pumpkin.toml.

Java Edition Authentication

pumpkin.toml

[networking.java.authentication]
enabled = true
fallbacks = []
profile_by_name_fallbacks = []
profile_by_uuid_fallbacks = []
connect_timeout = 5000
read_timeout = 5000
prevent_proxy_connections = false

[networking.java.authentication.player_profile]
allow_banned_players = false
allowed_actions = ["FORCED_NAME_CHANGE", "USING_BANNED_SKIN"]

[networking.java.authentication.textures]
enabled = true
allowed_url_schemes = ["http", "https"]
allowed_url_domains = [".minecraft.net", ".mojang.com"]

[networking.java.authentication.textures.types]
skin = true
cape = true
elytra = true

Configuration Options

• enabled: Enables online authentication for Java clients (default: true).
• url: (Optional) Custom authentication URL to verify join requests (e.g., custom auth servers like Drasl). Supports {username} and {server_hash} parameters.
• fallbacks: List of fallback authentication URLs contacted if the primary/official session server is unreachable.
• profile_by_name_url: (Optional) Custom URL template to fetch player profiles by username ({username}).
• profile_by_name_fallbacks: Fallback URLs for looking up player profiles by username.
• profile_by_uuid_url: (Optional) Custom URL template to fetch player profiles by UUID ({uuid}).
• profile_by_uuid_fallbacks: Fallback URLs for looking up player profiles by UUID.
• connect_timeout: Connection timeout in milliseconds when contacting authentication servers (default: 5000).
• read_timeout: Read timeout in milliseconds when contacting authentication servers (default: 5000).
• prevent_proxy_connections: Whether to block connections coming from proxies or VPNs during Mojang authentication (default: false).
• prevent_proxy_connection_auth_url: (Optional) Custom authentication endpoint used specifically when proxy prevention is enabled.
• services_url: (Optional) Public Minecraft services URL (used for player certificates and keys).

Player Profile Settings

• allow_banned_players: Whether to allow players flagged or banned by Mojang to connect (default: false).
• allowed_actions: Profile actions permitted when flagged players connect (e.g. ["FORCED_NAME_CHANGE", "USING_BANNED_SKIN"]).

Textures Settings

• enabled: Enables fetching and validating player skins, capes, and elytra textures (default: true).
• allowed_url_schemes: URL schemes permitted for texture downloads (default: ["http", "https"]).
• allowed_url_domains: Domains permitted for texture downloads (default: [".minecraft.net", ".mojang.com"]).
• types.skin: Enable custom player skins (default: true).
• types.cape: Enable player capes (default: true).
• types.elytra: Enable player elytra textures (default: true).

Bedrock Edition Authentication

pumpkin.toml

[networking.bedrock.authentication]
enabled = true
connect_timeout = 5000
read_timeout = 5000

Configuration Options

• enabled: Whether Xbox Live authentication is required for Bedrock clients (default: true).
• url: (Optional) Custom authentication or discovery endpoint URL.
• connect_timeout: Connection timeout in milliseconds (default: 5000).
• read_timeout: Read timeout in milliseconds (default: 5000).