Login

Carries the player's identity: an Xbox-authenticated JWT chain (or a PlayFab multiplayer token on 1.26.x clients) plus a client-data JWT with skin, device and locale claims.

connection request:
  int32 LE  <chain JSON length>
  ...       {"Certificate":"{\"chain\":[...]}", "AuthenticationType":2, "Token":"eyJ..."}
            -- or legacy: {"chain":["<jwt>","<jwt>","<jwt>"]}
  int32 LE  <client data JWT length>
  ...       client data JWT (header.payload.signature)

Structure

Notes

• First compressed, still unencrypted packet of the session.
• The connection request is varuint32-length-prefixed; its inner lengths are int32 little-endian.
• New 1.26.x envelope: {"Certificate": "<chain JSON>", "AuthenticationType": 1|2, "Token": "<multiplayer JWT>"}. AuthenticationType 2 (self-signed) is rejected by servers that require Xbox Live auth.
• Legacy envelope: {"chain": [identity, mojang, client]} — token 0 self-signed, token 1 signed by Mojang's ECDSA P-384 root key, token 2 carries extraData (XUID, identity UUID, displayName, titleId).
• The Token JWT is the OIDC multiplayer token issued by Minecraft's authorization service: claims ipt=PlayFab, mid (PlayFab id), tid (title, 20CA2 retail), cpk (client public key), xid (XUID), xname (gamertag). Servers verify it against the service's JWKS.
• Player UUID is derived from the XUID as an MD5 name-based (v3) UUID over "pocket-auth-1-xuid:<xuid>".
• The client-data JWT is signed with the cpk key and carries ClientRandomId, DeviceOS, DeviceId, LanguageCode, SkinData (base64 RGBA), SkinGeometryData, CapeData, PlayFabId, Nonce (LAN games must echo the nonce from discovery) and more.