Class EncryptedAuthCredentialStore

java.lang.Object
com.hypixel.hytale.server.core.auth.EncryptedAuthCredentialStore
All Implemented Interfaces:
IAuthCredentialStore
public class EncryptedAuthCredentialStore extends Object implements IAuthCredentialStore
Credential store that persists to an AES-256-GCM encrypted file.

The encryption key is derived via PBKDF2 from available passphrase sources.

Write priority (first available is used to encrypt new data):

  1. HYTALE_AUTH_KEY_FILE env var — path to a file containing the passphrase
  2. HYTALE_AUTH_KEY env var — passphrase provided directly
  3. Machine hardware UUID — makes credentials machine-bound (default)
  4. Auto-generated key file (auth.key) — created when no other source is available
Read priority (tried in order when decrypting existing data):
  1. HYTALE_AUTH_KEY_FILE / HYTALE_AUTH_KEY env vars
  2. Auto-generated key file (auth.key) — if present on disk, tried before hardware UUID to handle environments where machine identity is unstable
  3. Machine hardware UUID
This allows transparent migration: credentials encrypted with any prior key source are re-encrypted with the current write key on first successful load.

If an env var is explicitly set but its value cannot be used (unreadable file, empty file), construction fails with IllegalStateException. Encrypting with an unintended key would silently orphan credentials.