Authentication & Security Architecture

PocketMC implements security-in-depth across the application lifecycle. Because the software manages network ports, file modifications, and process executions, strict authentication protocols guard every API channel.

1. Platform-Native Secrets Encryption

Credentials (API keys, partner tokens, and OAuth refresh secrets) are never stored in plaintext on disk. PocketMC leverages platform security APIs:

• Windows Data Protection API (DPAPI): Keys are encrypted with ProtectedData.Protect with user-level scope. Only processes running under the same user profile can decrypt secrets.
• Linux Secret Service: Integrates with org.freedesktop.secrets via DBus, utilizing the system keyring (GNOME Keyring or KWallet).
• macOS Keychain: Secured using the macOS Security framework Services API.

2. Remote Control Web Panel Pairing

To control PocketMC remotely from a mobile browser or local network:

• QR Code Handshake: The desktop UI generates a single-use cryptographic pairing challenge displayed as a QR code.
• Session Token Minting: Scanning the QR code issues a cryptographically secure HMAC-SHA256 bearer token stored in the client session.
• Token Revocation: You can revoke all active mobile sessions immediately from the desktop Settings tab with one click.

3. Cloud OAuth Integrations

Cloud backup authentication (Google Drive, Microsoft OneDrive, Dropbox) uses standard OAuth 2.0 PKCE Authorization Code flows. PocketMC only requests the narrowest required scope (drive.file / files.content.write) to prevent broader account access.