> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.wynncraft.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.wynncraft.com/_mcp/server.

# Authentication

Since August 2025, Wynncraft Accounts introduced API features for authenticated users, including user-based caching and authenticated throttling.

The authentication system currently supports three user types:

| Type      | Description                                                                                         |
| --------- | --------------------------------------------------------------------------------------------------- |
| `SESSION` | Wynncraft website session-cookie authentication. This is not intended for third-party applications. |
| `TOKEN`   | Third-party-friendly authentication using an API token and the `Authorization` header.              |
| `OAUTH`   | OAuth2 application authentication using a bearer token tied to one user and one client.             |

## OAuth2 Clients

OAuth2 clients are intended for applications acting on behalf of a Wynncraft user.

Use OAuth2 when your application needs a user-granted identity and access context.

Current OAuth2 endpoints are under `/v3/oauth/*`.

* [POST /oauth/token](https://docs.wynncraft.com/modules/o-auth-2/exchange-oauth-token) exchanges an authorization code for an access token.
* [GET /oauth/me](https://docs.wynncraft.com/modules/o-auth-2/get-oauth-identity) returns the OAuth2-authenticated application and profile context.

## Creating Tokens

You can create up to 3 authentication tokens from your [Account Dashboard](https://wynncraft.com/account/dashboard?section=dev).

Each token is independent. For example, 3 tokens give each token its own authenticated rate limit per bucket.

When creating a token, provide:

* A name. This cannot be changed later.
* A description.

> **Warning**
>
> The token value is only shown once during creation. Store it securely.

## Public Tokens

Tokens can be set to Public Mode.

A public token:

* Acts as an authenticated guest.
* Hides your personal data and stats unless you made them public.
* Is recommended for public applications.

Use this mode when a token is used by public commands to avoid potential privacy leaks.

## Token Deletion

You may delete one token every 2 minutes. This prevents deletion abuse to bypass rate limits.

Token creation is not rate-limited.

## Authenticating Requests

Authenticated requests use the `Authorization` header:

```http
Authorization: Bearer <token-or-access-token>
```

> **Error**
>
> Never share account tokens or OAuth2 access tokens with anyone.