Projects, servers and access

A project groups its owner, game servers and subscription. A server scopes moderation, settings and extension connectivity. An ozProtect account, a staff SteamID and a Minecraft player ID have different purposes.

First project

1. Sign in through the configured account service. For the current panel, check Steam linking: bootstrap uses the account's steam_id even for Minecraft projects. A Minecraft UUID does not replace a staff account.
2. Create a project with a name and game. HTTP project.checkName checks naming conflicts; project.create creates the project, first server and source-defined trial. A trial implementation does not guarantee eligibility for a specific account.
3. Enter the server address and query port; check project/server game. Editing names, icons and other identity fields may require server.identity.
4. Obtain the required moderation/subscription state, assigned Network address and server credentials through the working account interface.
5. Install the adapter for your game. After connection, check the server, players and event history in the panel.

Owner server management uses project.createServer, project.updateServer, project.openServer and other methods in the HTTP reference. Do not give a project key to a player's browser or use it instead of personal staff authentication.

Roles and permissions

Level	Purpose
Project owner	Checked against project ownership; manages the project and owner-only settings
Server administrator	Server access and administrative operations within the role's configuration
Moderator	Actions allowed by individual permissions and server access
Service administrator	Separate staff role for .cp and administrative APIs; distinct from a game server administrator

The panel uses access.getStaff, access.addAdmin/removeAdmin, access.addModer/removeModer, access.getModer/setModer. The backend checks Project.HasProjectAccess, Project.HasServerAccess, groups and action permissions. For example, checks use permission checks, and ban operations may require bans.

A hidden button is not API protection. The backend checks data access; the selected server, role, license and dedicated scope must match. Errors such as access_denied, license_upgrade_required and dedicated_project_mismatch describe different requirements, not a reason to retry with another project's ID.

Connecting the panel

New browser clients obtain a short-lived personal panel token through SSO POST /auth/network-token, using cookie/CSRF and the selected project/server. account.genNetToken remains for the compatible legacy application and its key-based protocol. Socket.IO uses namespace /client, transport path /socket, WebSocket without polling. After token, host and access validation, the server sends panel initialization data in connected.

Switching servers requires the correct context. Do not reuse another server's socket for requests. For ozprotect_network_host_mismatch, use the assigned address from a verified response/account interface; retain host validation.

Account interface and panels

.land serves owners and players, .web handles daily moderation and .cp serves the ozProtect team. Similar billing screens do not imply interchangeable permissions.

Sources: api/project/Project.js, api/account/Account.js, socket/client/Access.mjs, modules/ProjectStaff.js, common/ApiNet.js, .web and .cp routes.

Moderation · Subscriptions and features