Hytale Server Authentication Guide: /auth login device Step by Step
A new Hytale server is not ready for players until it has been authenticated with a Hytale account. The step takes about a minute, but it is the first thing that trips people up, because the code expires, the console message is easy to miss, and the docs say little about what an unauthenticated server actually does.
This guide covers the device login flow, every /auth command Hytale documents, how long a login lasts, the limit on servers per game license, and a troubleshooting table. It also explains what to do if your server is hosted. Hytale is in Early Access, so details such as command output may change; check Hytale's Server Manual after major updates.
- Run
/auth login devicein the server console. Visit accounts.hytale.com/device, enter the code shown, and approve it within 900 seconds. - Success looks like
Authentication successful!withMode: OAUTH_DEVICE. Hytale's manual says that once authenticated, your server can accept player connections. - Hytale states a limit of 500 servers per game license. Its provider guide describes it as 500 concurrent server sessions per account.
- A server whose token check fails starts unauthenticated and prints
Use /auth login to authenticate. Run/auth statusto see where you stand. - You normally do not need to log in again: the server refreshes its tokens itself. The exception is a server that has been offline for more than 30 days.
- On ChicagoServers, type the command into the Console tab and press Send. If you get stuck, contact support.
On this page
Why a Hytale server must be authenticated
Hytale's Server Manual gives two reasons: authentication enables communication with Hytale's service APIs, and it counters abuse. Hytale's separate guide for hosting providers adds the practical detail. The server uses its OAuth tokens to create game sessions under the operator's profile, to validate players who join, and to reach game assets and version information.
That makes authentication more than a formality. Player validation depends on it, which is why the manual says that once authenticated, your server can accept player connections. The documentation does not spell out every symptom of skipping it, so plan on an unauthenticated server not being joinable.
Log in with the device code flow
The device code flow is the method Hytale recommends for headless servers, which means any server without a desktop, including every hosted one. You start it on the server and finish it in a browser on whatever device you like.
- Start the server
Launch it normally. If you have not done that yet, see the dedicated server setup guide.
- Run the login command
In the server console, type
/auth login device./auth login device - Open the device page
The console prints a banner pointing to accounts.hytale.com/device and a code in the form
ABCD-1234. The banner also gives a direct link with the code prefilled. Open either in any browser and sign in with your Hytale account. - Approve before it expires
The console shows
Waiting for authorization (expires in 900 seconds).... That is 15 minutes. If the code runs out, run/auth login deviceagain to get a new one. - Check the result
On success the console reports
Authentication successful!withMode: OAUTH_DEVICE.
Every /auth command Hytale documents
| Command | What it does |
|---|---|
/auth login device | Starts the device code flow. Recommended for headless servers. |
/auth login browser | Starts a browser PKCE flow. Needs a desktop environment, so it is no use on a hosted server. |
/auth select <number> | Chooses a profile when your account has several. |
/auth status | Shows the current authentication status. |
/auth cancel | Cancels a login that is in progress. |
/auth logout | Clears authentication and ends the session. |
/auth persistence | Shows how credentials are stored. |
/auth persistence <type> | Changes storage to Memory or Encrypted. |
When you are unsure whether a server is logged in, /auth status is the first command to run. It reads state and changes nothing.
How long a login lasts
You authenticate once, not every start. Hytale's provider guide lists the lifetimes behind that behaviour.
| Item | Lifetime | Notes |
|---|---|---|
| Device code | 900 seconds | The window to approve the login in your browser. |
| OAuth access token | 1 hour | Used to create game sessions and talk to the service APIs. |
| OAuth refresh token | 30 days | Rotated on every use, and the old one stops working. |
| Game session | 1 hour | Refreshed automatically 5 minutes before it expires. |
The guide says a running server stays authenticated indefinitely while it keeps refreshing. You need to log in again only if the server was offline for more than 30 days, or if you logged out. If you run your own machine, keep the credential files intact: in the bootstrap flow they are stored as auth.enc and auth.key in the Server/ folder, and the manual says they carry over to the real server. Treat both files as secrets and never share them.
The manual does not explain the difference between the Memory and Encrypted storage types in detail, so check /auth status after a restart if you change /auth persistence.
The 500-server limit
The Server Manual says each Hytale game license is limited to 500 servers, to prevent early abuse. Hytale's provider guide describes the same ceiling slightly differently: each account is limited to 500 concurrent server sessions, and creating more returns a 403 Forbidden. Either way, an ordinary community owner is nowhere near it. If you do need more capacity, both documents say to contact Hytale support.
If you see a 403 when a server tries to start a session, stop servers you no longer use before assuming something else is wrong.
What an unauthenticated server looks like
When the server cannot validate its tokens at start-up, it does not stop. It starts unauthenticated and prints a message like this:
Token validation failed. Server starting unauthenticated. Use /auth login to authenticate.The provider guide lists three common causes of that failure: expired tokens, an invalid token signature, and a missing required scope. The recovery is the same in every case: run /auth login device, or supply new tokens if your host does that for you.
The help output also shows an --auth-mode option with the values authenticated and offline, defaulting to AUTHENTICATED. Hytale's manual does not describe offline mode, so this guide does not recommend it for a public server.
Troubleshooting
| Symptom | Likely cause | What to try |
|---|---|---|
| Code is rejected or nothing happens after you approve | The 900 seconds ran out | Run /auth login device again and approve the new code straight away. |
| Console says it is waiting but you changed your mind | A login is still pending | Run /auth cancel, then start again. |
Token validation failed at start-up | Expired token, bad signature or missing scope | Run /auth login device. Check /auth status afterwards. |
| More than one profile is offered | Your account has several profiles | Run /auth select <number> with the one you want. |
403 Forbidden on session creation | Server limit reached, or the account lacks entitlement | Stop unused servers. Make sure the account you used owns the game. |
| Was fine, now unauthenticated after a long break | Server offline for more than 30 days, or you logged out | Run /auth login device again. |
| Login worked but players still cannot join | Not an auth problem | Check client and server versions, the UDP port and the whitelist. See the updates and versions guide. |
When asking for help, include the exact console message and the output of /auth status. Both are quicker to act on than a description.
Authenticating a hosted server
Hytale's provider guide notes that hosts can manage tokens centrally so customers never see an auth prompt, and that hosts can use token passthrough or a credential store. Whether a given host does that is the host's choice, so on a hosted server the first thing to do is check rather than assume.
- Open the Console
Sign in at panel.chicagoservers.co, open your server under Your servers, and select the Console tab.
- Check the status
Type
/auth statusand press Send. If it shows the server as authenticated, you are done. - Log in if needed
Type
/auth login deviceand press Send. Follow the banner in the console, and approve the code within 900 seconds. - Ask support if it will not go through
If the code never appears, keeps expiring or you hit an error, contact ChicagoServers support and include the console text.
The console commands above are the game's own and are what Hytale documents. If anything is unclear, contact support.
Running this on ChicagoServers
Hytale server hosting on ChicagoServers is $15/mo and comes with 24/7 support, a 7-day money-back guarantee and a free 24-hour trial, and support can help if authentication does not go through. For the wider setup, read the setup guide.
Frequently asked questions
How do I authenticate a Hytale server?
Run /auth login device in the server console. The console shows a device page address (accounts.hytale.com/device) and a code such as ABCD-1234. Open the page in a browser, sign in with your Hytale account and enter the code. The console then reports Authentication successful! with Mode: OAUTH_DEVICE.
How long is the Hytale device code valid?
900 seconds, which is 15 minutes. The console shows 'Waiting for authorization (expires in 900 seconds)'. If it expires, run /auth login device again to get a fresh code.
Do I have to authenticate every time I start the server?
No. Hytale's provider guide says the server refreshes its tokens automatically and stays authenticated as long as it keeps refreshing. You need to log in again only if the server was offline for more than 30 days or you logged out.
How many Hytale servers can one account run?
Hytale's Server Manual states a limit of 500 servers per game license. The provider guide describes it as 500 concurrent server sessions per account, with a 403 error beyond that. Contact Hytale support if you need more.
What happens if my Hytale server is not authenticated?
The server starts anyway but prints 'Token validation failed. Server starting unauthenticated.' Hytale's documentation says an authenticated server can accept player connections and does not describe the unauthenticated case in detail, so treat the server as not ready for players until /auth status shows it logged in.
Can I authenticate from the ChicagoServers panel?
You can run the game command from the Console tab: type /auth login device, press Send, then approve the code in your browser. Check /auth status first, because your server may already be authenticated. If anything fails, contact support.