Skip to main content
rLogin has exactly two permission nodes. Logging in is not a privilege, so the player commands are not gated behind anything.

​
rlogin.admin

Covers reload, info, unregister, forcelogin, changeuuid, migrate, lang, and all four spawn subcommands.
forcelogin logs a player in without their password, and unregister deletes an account outright. Grant this to staff you would trust with op, because it is functionally close to it.

​
rlogin.bypass

A player with this node is never asked to log in and is never frozen. It exists for NPCs, Citizens entities and test bots — things that occupy a player slot but have nobody to type a password. It is false by default and should stay that way for humans.
Granting rlogin.bypass to a real player means anyone who connects with that name is let straight in. On a cracked server, that is anyone at all.

​
What is not a permission

/login, /register, /changepassword, /logout, /2fa and /premium are available to everyone. Gating them would lock players out of the only commands that can let them in.
Not a permission — it is the result of a Mojang verification. There is no node that makes someone premium, because a node cannot prove ownership of an account.