Remote Dashboard
PocketMC embeds an ASP.NET Core Kestrel web server on port 25580. It serves an administration dashboard bundled inside the executable, letting you manage servers from a phone, tablet, or secondary computer without installing third-party web servers.
Enabling Remote Control
Turn on the web dashboard through the desktop settings:
- Open PocketMC and go to SettingsRemote Control.
- Enable the Enable Remote Control Server switch.
- Confirm the listening port (default is
25580). - Add your initial administrator username and password.
The server binds to 0.0.0.0:25580 by default, accepting connections from your local network. You can restrict binding to 127.0.0.1 if you only intend to access the panel locally or through an SSH tunnel.
Access Modes
PocketMC supports three connection modes depending on whether you are on the same local network or connecting remotely over the internet:
| Mode | Protocol | Description |
|---|---|---|
LAN Only (0) | HTTP | Binds to your local IP address (for example, http://192.168.1.50:25580). Accessible to devices connected to the same Wi-Fi or subnet. |
Cloudflare Quick Tunnel (1) | HTTPS | Supervises an ephemeral cloudflared.exe process to expose the dashboard via a public https://*.trycloudflare.com address with automatic TLS certificates. Requires no Cloudflare account or router port forwarding. |
Playit.gg HTTPS Tunnel (2) | HTTPS | Routes traffic through the managed Playit agent using a dedicated HTTP/HTTPS tunnel definition, keeping external access tied to your existing Playit account. |
Quick QR Access
To open the dashboard on a mobile device without typing IP addresses or tunnel domains:
- Navigate to SettingsRemote Control in the desktop app.
- Click Dashboard QR Code to view the generated QR code.
- Scan the code with your phone camera. The QR code contains the full URL including port and protocol, opening the dashboard in your mobile browser.
Authentication and Session Lifecycles
Remote requests authenticate through cookie-based sessions:
- Cookie Name:
PocketMCRemoteAuth. - Flags: Marked
HttpOnly,SameSite=Strict, with a 24-hour expiration window. - Security Stamp Validation: Every account maintains a random GUID security stamp. Updating a user password or altering their permission flags rotates this stamp, immediately invalidating any active cookies across all devices.
- Rate Limiting: The built-in request limiter restricts login attempts to 5 per minute per IP address. Failed attempts beyond this threshold return an immediate
429 Too Many RequestsHTTP response. - Command Rate Limiting: Console command submissions are capped at 30 commands per minute per instance to prevent process buffer saturation.
User Accounts and Permission Scopes
You can configure multiple user accounts with restricted capabilities so moderators or server co-hosts only access what they need:
| Permission Scope | Allowed Operations |
|---|---|
AllowRemoteConsoleCommands | Connect to WebSocket terminal streams (/ws/instances/{id}/console) and submit commands via POST /api/instances/{id}/console/command. |
AllowRemotePlayerActions | Kick, ban, pardon, op, and de-op players through the web interface. |
AllowRemoteServerSettings | Read and modify server.properties configurations. |
AllowRemoteServerAddons | List installed plugins or mods, toggle them on or off, and uninstall packages. |
AllowRemoteFileManager | Browse directories, edit text files under 1 MB, upload files up to 100 MB, and delete files inside the instance directory. |
AllowRemoteServerBackups | View backup history and trigger manual RCON-safe world backups. |
AllowedInstanceIds | Array of server instance GUIDs. When populated, the user only sees and interacts with the listed instances. |