BetaKey Website
BetaKey 4.0 comes with its own website. It runs directly inside the plugin on your Minecraft server or proxy, so you don't need a separate webserver, PHP or an extra database. Players redeem their keys on it, and admins manage all keys in the admin panel.
This is the recommended website. Use the
legacy website only if your host can't give you a second port.
Features
- Redeem page: players enter their Minecraft name and their key. BetaKey checks the name with Mojang and stores the UUID.
- Admin panel on
/admin: statistics, who uses which key, search, creating and deleting keys.
- Themes: change the design with your own templates and CSS, without changing the plugin.
- Languages: English and German included, the visitor's browser language is chosen automatically.
- Works with every database BetaKey supports: SQLite, MySQL, MariaDB and PostgreSQL.
- Protection: rate limits against guessing keys, salted and hashed admin passwords, optional ingame confirmation of admin logins.
Requirements
- BetaKey 4.0 or newer (Spigot/Paper 1.8.8+, BungeeCord or Velocity)
- A free TCP port for the website,
8080 by default. Your host must let you open it (firewall / port forwarding).
Only one port available? Many Minecraft hosts only give you the game port. In that case the new website can't be reached from the internet. Use the
legacy website on a separate webserver instead.
Quick start
- Enable the website ingame or in the console:
/betakey website enable
This sets Website.Enabled: true in the config.yml and starts the website right away. You can also change it in the config.yml yourself and run /betakey reload.
- Check that it is running:
/betakey website
This shows all website commands and the address, e.g. The website is running on http://<server-ip>:8080/.
- Open
http://<your-server-ip>:8080/ in your browser. You should see the redeem page.
- Optional: set your server name, port and theme in
plugins/BetaKey/website/settings.yml and run /betakey reload.
The website folder is created on the first start, also while the website is disabled. On Velocity the plugin folder is plugins/betakey.
The website folder
plugins/BetaKey/website/
settings.yml port, address, theme, language, admin panel
lang/en.yml texts of the website
lang/de.yml
themes/default/ the default theme
themes/dark/ example theme, only overrides a few files
Missing files are restored on startup, but existing files are never overwritten. To get the newest version of a file after an update, delete it and restart the server or run /betakey reload.
settings.yml
| Setting |
Default |
Description |
Host |
0.0.0.0 |
Network address the website listens on. 0.0.0.0 means all addresses. Use 127.0.0.1 if only a reverse proxy on the same machine should reach it. |
Port |
8080 |
Port of the website. |
PublicUrl |
'' |
The address players use, e.g. https://beta.yourserver.net/. Shown by /betakey website. An https:// address also marks the admin login as encrypted. |
ServerName |
Your Server Name |
Shown in the header of the website. |
Theme |
default |
Folder name in website/themes. |
DefaultLanguage |
en |
Used when the browser language has no file in website/lang. |
Cache |
true |
Caches the templates. Set it to false while you work on a theme, so changes show up without a reload. |
Threads |
4 |
Threads that handle requests. The default is enough for almost every server. |
TrustProxyHeaders |
false |
Only set to true behind a reverse proxy, see HTTPS. |
RateLimit.RedeemAttemptsPerMinute |
5 |
Redeem attempts per visitor IP and minute, 0 disables the limit. |
AdminPanel.Enabled |
true |
Enables the admin panel on /admin. |
AdminPanel.Authentication |
BOTH |
How admins log in: PASSWORD, INGAME or BOTH, see below. |
AdminPanel.SessionTimeout |
30 |
Minutes until an inactive admin is logged out. |
AdminPanel.LoginAttemptsPerMinute |
5 |
Login attempts per visitor IP (and per admin name) and minute. |
Run /betakey reload after changing the settings.
Admin panel
The admin panel is available on <website>/admin, e.g. http://<server-ip>:8080/admin. It shows how many keys exist, how many are used and unused, which player uses which key, and lets you search, create (1-100 random keys or a custom key) and delete keys. Every action is logged in the server console.
Login methods
| Authentication |
How admins log in |
PASSWORD |
Minecraft name and password. |
INGAME |
Minecraft name, then the admin confirms the login ingame with /betakey verify <code>. |
BOTH (default, recommended) |
Password and ingame confirmation. |
Setting up an admin
- Join the server with a player that has the permission
betakey.admin and set your password:
/betakey website password <password>
The password needs 8 to 128 characters. It is stored salted and hashed in the database, and BetaKey hides this command from the server log.
- Open
/admin on the website and log in with your Minecraft name and the password.
- With
BOTH or INGAME the website now shows a code. Run it ingame with the same player:
/betakey verify 123456
Only the player who logs in can confirm the login, other admins can't. The page continues automatically.
To remove the access of an admin, run /betakey website removepassword <player>. This also logs out all sessions of that admin.
Admin sessions are kept in memory. A server restart or /betakey reload logs all admins out.
HTTPS with a reverse proxy
The website itself uses HTTP. Without HTTPS, admin passwords are sent unencrypted, and BetaKey warns about this in the console and on the login page. For a public website, put it behind a reverse proxy like nginx (with a Let's Encrypt certificate) or Cloudflare.
- Let the website only listen locally:
Host: 127.0.0.1
- Set your address:
PublicUrl: 'https://beta.yourserver.net/'
- Set
TrustProxyHeaders: true, so the rate limits use the real visitor IP.
- Configure the proxy, for example nginx:
server {
listen 443 ssl;
server_name beta.yourserver.net;
ssl_certificate /etc/letsencrypt/live/beta.yourserver.net/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/beta.yourserver.net/privkey.pem;
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;
# set the visitor IP yourself, so visitors can't fake it
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header CF-Connecting-IP $remote_addr;
}
}
Only enable TrustProxyHeaders if the website can only be reached through your proxy (Host: 127.0.0.1 or a firewall). Otherwise visitors could fake their IP address and bypass the rate limits.
Themes
A theme is a folder in website/themes. It only needs the files it changes, everything else is taken from its parent theme and finally from the default theme. Templates use Pebble.
themes/mytheme/
theme.yml Name, Author and Parent
templates/layout.peb page frame (blocks: title, head, header, content, footer)
templates/redeem.peb the redeem page
templates/admin/ admin panel pages (login.peb, verify.peb, dashboard.peb)
assets/ css, images, ... available as /assets/<file>
Create your own theme
- Create the folder
website/themes/mytheme with a theme.yml:
Name: My Theme
Author: You
Parent: default
- Add
assets/mytheme.css with your colors. The default theme uses CSS variables, so a few lines are enough:
:root {
--accent: #e67e22;
--accent-hover: #d35400;
}
- Add
templates/layout.peb, which extends the default layout and loads your CSS:
{% extends "default:layout.peb" %}
{% block head %}
{{ parent() }}
<link rel="stylesheet" href="/assets/mytheme.css">
{% endblock %}
- Set
Theme: mytheme in the settings.yml and run /betakey reload.
- Don't edit the default theme. Create your own theme instead, so you keep getting the newest default files.
{% extends "default:layout.peb" %} extends the template of a specific theme. {{ parent() }} keeps the content of the parent block.
- Texts come from the language files:
{{ t('heading') }}.
- All template variables are listed at the top of
themes/default/theme.yml.
- Set
Cache: false while you work on the theme.
Languages
The texts of the website are in website/lang, one file per language (en.yml, de.yml). The visitor's browser language is used automatically, and visitors can switch the language at the bottom of the page. To add a language, copy en.yml, e.g. to fr.yml, and translate it. Texts missing in a file are taken from the English file.
The ingame messages of BetaKey are in a separate folder, plugins/BetaKey/messages.
BungeeCord and Velocity networks
Enable the website on one BetaKey instance only, usually the proxy. If BetaKey runs on several servers, they all have to use the same MySQL, MariaDB or PostgreSQL database. SQLite only works for one server.
Commands
All commands need the permission betakey.admin. In the chat you can click a command in /betakey website to use it.
| Command |
Description |
/betakey website |
Shows the website commands, the status and the address. |
/betakey website enable |
Enables the website in the config.yml and starts it. |
/betakey website disable |
Stops the website and disables it in the config.yml. |
/betakey website password <password> |
Sets your admin panel password (players only). |
/betakey website removepassword <player> |
Removes the admin panel password of a player. |
/betakey verify <code> |
Confirms your admin panel login with the code from the website. |
/betakey reload |
Loads the config and website settings again and restarts the website. |
/betakey debug |
Shows all information for the support, including a "Website information" section. |
Troubleshooting
| Problem |
Solution |
| Console: The website could not be started, port 8080 is already in use or not allowed |
Another program uses the port, or your host doesn't allow it. Change Port in the settings.yml and run /betakey reload. |
| The website runs, but can't be opened from outside |
Open the port in your firewall or the panel of your host. If your host only gives you one port, use the legacy website. |
| Console: The admin panel uses HTTP, so passwords are sent unencrypted |
Use HTTPS with a reverse proxy and set the PublicUrl, see HTTPS. |
| Console: The website theme 'x' does not exist |
The Theme in the settings.yml has no folder in website/themes. The default theme is used meanwhile. |
| The page shows 500 Internal Server Error |
Usually a mistake in a theme template. /betakey debug shows the last error under "Last request error". |
| This Minecraft account does not exist, although it does |
The Mojang API may be busy for a moment. Wait a minute and try again. |
/betakey verify says the code is wrong |
The code is valid for 5 minutes and can only be confirmed by the player who logs in. Log in again on the website to get a new code. |
If you need help, run /betakey debug and send the output to the support. It contains no passwords, tokens or codes.