Back to Developer Portal
Authentication & Security
Security architecture and credential management across the PocketMC desktop client and API daemon.
1. Platform-Native Secrets Encryption
API keys, partner secrets, and OAuth refresh tokens are encrypted at rest using OS hardware-backed cryptographic facilities:
Windows DPAPI
Bound to the Windows user SID using ProtectedData. Other user accounts or processes cannot decrypt stored secrets.
Linux Secret Service
Integrated via DBus with GNOME Keyring or KWallet for session-level credential isolation.
macOS Keychain
Secured inside Apple Keychain Services with access controls restricted to the application bundle.
2. Remote Control Web Panel Pairing
When connecting to the local desktop service from a mobile phone or secondary device on the local network:
- QR Code Handshake: The desktop UI renders a single-use cryptographically signed pairing challenge.
- HMAC Session Minting: Scanning the challenge issues an HMAC-SHA256 bearer token valid only for that client device.
- Instant Revocation: Active sessions can be audited and terminated immediately from App Settings with one click.
3. Cloud OAuth PKCE Exchange
Cloud backup authorization (Google Drive, Microsoft OneDrive, Dropbox) uses standard OAuth 2.0 with Proof Key for Code Exchange (PKCE):
- Least Privilege Scopes: Access is restricted strictly to application-created files, preventing access to the rest of the user drive.
- Direct Upload Pipe: Backups stream directly from the user PC to cloud storage endpoints. Tokens are stored only in the local DPAPI vault.