OTPplease

OTPplease

Players generate short alphanumeric IDs unique to them. Players with the permission node can look up whom an ID belongs to and whether it has been checked before. Useful for verify flows, ticketing, where you can not have a direct hook/interface into another system where you need to verify players identity.

IDs are derived from HMAC-SHA256(server_secret, uuid:slot) truncated to base62. The algorithm is public but the secret is not, so players cannot predict or forge IDs even with access to this source code. The secret is generated on first run and stored in config.yml — keep it private.

Commands

Permissions

config.yml

# Characters per ID. Minimum 4 recommended.
id-length: 6

# How many IDs one player can hold at once.
max-ids-per-player: 32

# Rate-limit groups for /checkid.
# Players with no matching permission are unlimited. Console is always unlimited.
# If a player matches multiple groups, the most permissive (highest rate) wins.
checkid-cooldowns:
  - permission: otpplease.checkid.cooldown.standard
    limit: 10
    window-seconds: 60       # 10 checks per minute
  - permission: otpplease.checkid.cooldown.strict
    limit: 5
    window-seconds: 3600     # 5 checks per hour

# Auto-generated on first run. Do not share or change unless you want to invalidate
# the generation algorithm (existing IDs in ids.yml still resolve via /checkid).
secret: ""

Data

plugins/OTPplease/ids.yml stores all IDs. Each entry holds the owning player's UUID, their last known name, and whether the ID has been verified. The file is rewritten on every change; do not edit it while the server is running.

Rate-limit state is in memory only and resets on restart.