How to let the DzBot bot into your server — and Bedrock into your Java
Step by step, with the commands ready to copy. Everything here was measured on a real Paper 26.3 server, with the bot joining through the panel and Geyser translating the Bedrock client.
Read this before touching any configuration
This guide is what WORKS, measured — it is not a list of what DzBot promises. What still does not work is written in the “What still does NOT work” section, and it is written because it was measured not to work. When something differs from your server, the error your server returned is written next to the step.
WHAT STILL DOES NOT WORK (short version)
The full list, with the reason for each one, is at the bottom of this page:
- NetherNet is already enabled in Geyser, but the ports still have to be opened on the router (UDP 19133 and TCP 19132).
- With the Bedrock login turned off, anyone can join using somebody else’s name.
- The Bedrock bot has no XUID: it is not an operator through Xbox, only through ops.json.
- GrimAC recorded 277 violations for the bot: it gets into the server, but the anticheat does not yet accept it as a legitimate client.
- GrimAC warns that ViaBackwards on a 1.21.2+ server is “currently unsupported” (it affects vehicles with old clients).
The path, step by step
Java 25 — without it the server never opens the port
From 26.1 onwards, Paper requires Java 25 or newer. On Java 21 the process dies before the port opens, and the message shows up in the log — not on screen.
java -version
ls /usr/lib/jvm/openjdk version "25.0.4.1" 2026-08-18
OpenJDK Runtime Environment (build 25.0.4.1)
OpenJDK 64-Bit Server VM (build 25.0.4.1, mixed mode, sharing)On this machine Java 25 lives in /usr/lib/jvm/java-25-openjdk/bin/java — and that is the path that goes into the command that starts the server (step 5).
Minecraft 26.1 and newer requires running the server with Java 25 or aboveOn Ubuntu/Debian: sudo apt install openjdk-25-jdk · The Paper build used for the measurement was build 211 — that is what the server announces: 26.3-211-main@2d602d6. The server’s file is named paper-26.3-40.jar: the name comes from an older build and stayed because the script that starts the server points at it.
eula.txt, server.properties and ops.json
Three files. The first is the licence acceptance; the second says how the server behaves; the third is who grants operator in offline mode.
eula=trueWithout it the server does not start: it stops on the first boot asking for the acceptance and never opens the port.
server-port=25565
online-mode=false
level-type=minecraft\:flat
difficulty=peaceful
gamemode=survival
spawn-protection=0
white-list=false
view-distance=6
max-players=20server-port=25565The Java TCP port. It is the same one you type in the panel.online-mode=falseNo Microsoft account. It is what lets the bot join with a name and no password — and it is what makes the UUID the “offline” one (see ops.json).level-type=minecraft\:flatFlat world. The “\:” is Java’s own escape: without it the server does not read the line.difficulty=peacefulThe value measured on the test server. It does not change how the bot joins — it changes the game (no mobs, no hunger).gamemode=survivalSame: the measured value. The bot joins in survival.spawn-protection=0No spawn protection: the bot can dig and build anywhere, including the spawn point.white-list=false⛔ Paper 26.3 ships with white-list=true. With the whitelist on, whoever joins is kicked right away — and the bot never even shows up.view-distance=6How many chunks the server sends. It is how much world the bot can see.max-players=20The value measured on the test server.
⛔ The whitelist is mistake number one
Paper 26.3 starts with white-list=true. With the whitelist on, the server kicks whoever joins with “You are not whitelisted on this server!” — and the bot never reaches the panel. Set it to false.
[
{
"uuid": "6dab31a9-d6e5-37ee-bfd9-83901093485f",
"name": "DuGueDark",
"level": 4,
"bypassesPlayerLimit": false
},
{
"uuid": "0ca09961-3774-3c9d-b7a6-af349b4a773f",
"name": "DzBot",
"level": 4,
"bypassesPlayerLimit": false
}
]With online-mode=false the server computes each player’s UUID from the name: it is the md5 of “OfflinePlayer:<name>”, version 3. That UUID is NOT the premium UUID of the Microsoft account. Measured on this server: DzBot → 0ca09961-3774-3c9d-b7a6-af349b4a773f and DuGueDark → 6dab31a9-d6e5-37ee-bfd9-83901093485f.
The trap: the console answers “Nothing changed. The player is already an operator” and the player is still NOT an operator. That is because the stored UUID was the premium one, while the server looks for the offline one. With the right ops.json, the console stops complaining.
The shortcut that always works: type /op DzBot in the server console. It resolves the UUID by itself and writes the right one into ops.json.
The plugins that work on 26.3
All of these were loaded by Paper 26.3 build 211 and behaved well. GrimAC is the most useful one: it is the “cricket” that tells you whether the bot placed the block WITH line of sight.
- Geyser-Spigot2.12.0-b1268
Lets the Bedrock client join the Java server (and translates the protocol).
download.geysermc.org - Floodgate-Spigot2.2.5 (build 141)
The Bedrock identity: it is what signs the name of the player joining through Geyser.
download.geysermc.org - ViaVersion5.12.2-SNAPSHOT
Old Java client on a new server (for whoever joins with 1.20 or 1.21).
modrinth.com - ViaBackwards5.12.2-SNAPSHOT
Old server for a new client — the other way around from ViaVersion.
modrinth.com - GrimAC2.3.75-8baa16f
Anticheat. It tells you, by name, when the bot did something it should not.
modrinth.com
GrimAC is your measuring instrument
It flags FarPlace (the bot placed the block from too far) and RotationPlace (it placed with the wrong rotation). If the bot fails to place a block, GrimAC names the exact reason — and that is why it stays on the test server. And the most important part: GrimAC also flags the BOT ITSELF, by rule name. The flags below are the bot’s measured behaviour, not an anticheat false positive. GrimAC also warns in the log that ViaBackwards on a 1.21.2+ server is “currently unsupported”.
- 121×Postpackets sent out of the expected movement tick order
- 67×Simulationthe bot moved differently than the simulation predicted
- 39×RotationPlaceplaced a block without looking at it
- 20×FarPlaceplaced a block from too far away
- 18×GroundSpoofclaimed to be on the ground when the simulation says otherwise
- 9×AntiKBdid not take the expected knockback (the bot cancels the push)
- 3×AimModulo360sent a large yaw snap in one go
277 violations for DzBot and 0 for the human player (measured in GrimAC’s database, plugins/GrimAC/data/history.v1.db). The way for the bot not to be flagged is to do what a legitimate client does: the right reach, the right face, on the ground, no spurious entity action, and a human cadence.
⛔ Do not use a backpack plugin that sends a resource pack
BackpackPlus 3.2.0 was removed from the test server because it sends a resource pack (pack/resourcepack.zip) and the bot’s client failed while reloading resources. If you want a backpack, pick one that does not send a pack — or accept that the bot may lose it on reload.
Geyser: the THREE keys the offline Bedrock client needs
Geyser turns the Bedrock client into Java. Without the first TWO keys below, the Bedrock bot is refused with “§rFaça login no Xbox para ingressar neste servidor” — and it is not a port problem, not a version problem and not a firewall problem. The third one (NetherNet) is the new Bedrock path and does not change how the bot gets in: it changes what the router has to let through.
The file is plugins/Geyser-Spigot/config.yml.
1) auth-type: floodgate
Section java: — the default is online
java:
auth-type: floodgateTells Geyser that the Bedrock identity comes from Floodgate, and not from a Microsoft login.
2) validate-bedrock-login: false
Section advanced: → bedrock: — the default is true
advanced:
bedrock:
validate-bedrock-login: falseThis is the key that refuses the self-signed Bedrock login. The offline bot signs its own name, so it has to be off.
3) NetherNet (the new Bedrock path)
Section bedrock: → signaling: — the default is transport: raknet
bedrock:
port: 19132
webrtc-port: 19133
transport: both
signaling:
mode: builtinGeyser warned that NetherNet was not enabled and that, from October 27, Bedrock starts using it. With these keys the warning disappears and the log says: “Built-in signaling started on http://0.0.0.0:19132, with NetherNet on UDP port 19133”. ⚠️ What is still missing is the port forwarding on the router: UDP 19133 and TCP 19132. Measured here: STUN discovery mapped this host to public port 32563, which is not 19133 — a sign that the provider’s NAT changes the port. If yours does not pass the same port, put your public IP in signaling: → advertise-addresses:.
The panel still uses Geyser’s UDP 19132 port for Bedrock: NetherNet does not change the panel field, it changes what the router has to let through.
⚠️ This opens a hole — read before applying it
With validate-bedrock-login off, ANYBODY can join using anybody else’s name. Geyser itself says so in the file: “Disabling Bedrock authentication for other use-cases is NOT SUPPORTED, as it allows anyone to spoof usernames, and is therefore a security risk.” If the server is only yours and the bot’s, that is fine. If the server is public and has XP, ranking or PvP, the right move is to leave the Bedrock login on (true) and use a real Xbox account for the bot — then the bot is no longer offline (and it gets an XUID).
The two keys only take effect after you restart the server.
The server console (over a FIFO)
If you started the server with & at the end of the line, the console disappears when the terminal closes. The way to have a real console on Linux is a FIFO: a file the java reads as input and that you write to with echo.
cd /home/duguedark/Servers/dzbot-26.3
JAVA=/usr/lib/jvm/java-25-openjdk/bin/java
[ -p consola ] || mkfifo consola
setsid "$JAVA" -Xms512M -Xmx1200M -jar paper-26.3-40.jar --nogui < consola > saida.log 2>&1 &
sleep 100000 > consola &⛔ Without the live writer, the java HANGS
The last line (sleep 100000 > consola &) is not decoration: it is the writer that keeps the FIFO open. Without it the java hangs on the FIFO open — the server does not start, does not open the port and writes NOTHING to the log. It is the classic “it does not work and does not say why”.
Sending a command
echo "op DzBot" > consolaWhat the console writes comes back in saida.log. And it is through the console that you give /tp and /give to the bot — never through chat (see the traps).
The exact fields in the panel
With the server up, the bot joins through the DzBot panel. These are the measured values:
- HostJava
127.0.0.1Bedrock127.0.0.1 - PortJava
25565Bedrock19132 - VersionJava
26.3Bedrock1.26.51 - UsernameJava
DzBotBedrockDzBot - AuthJava
offlineBedrockoffline
The Bedrock port is Geyser’s UDP port (19132 by default), not the Java one. If you changed the port in Geyser’s config.yml, that is the one to use here.
Version 26.3 is the one the panel offers for Java, and 1.26.51 for Bedrock. If your Bedrock build is another one, use the equivalent.
auth: offline on Bedrock is what gives the bot an identity without an Xbox account. The price: no XUID — the bot is not an operator through Xbox, only through ops.json (level 4, like the rest).
DzBot[/127.0.0.1:52214] logged in with entity id 103 at ([minecraft:overworld]7.45, -60.0, 0.39)After you start it, the server log shows the proof: DzBot[/127.0.0.1:52214] logged in with entity id 103 — that line is what says the bot got in.
Measured traps
The ones that really cost time on this test server.
The whitelist kicks the bot
Paper 26.3 ships with white-list=true. Whoever joins is kicked with “You are not whitelisted on this server!” — and the bot never shows up in the panel.
A FIFO without a writer hangs the java
Without sleep 100000 > consola &, the process hangs on the FIFO open: it does not start, does not open the port and logs nothing.
Paper’s spam filter kicks the bot
Every chat message counts. Three chat commands = a kick. To move the bot use /tp and /give from the console, never from chat.
Offline UUID is not the premium UUID
In offline mode the UUID is the md5 of “OfflinePlayer:'<name>'”. If ops.json holds the Microsoft account UUID, the console says “Nothing changed…” and the player stays without operator.
Geyser without the two keys refuses the Bedrock client
The symptom is “Faça login no Xbox para ingressar neste servidor” — and it looks like an account problem, when it is Geyser configuration.
Java 21 does not boot 26.3
The process dies with “Minecraft 26.1 and newer requires running the server with Java 25 or above”.
What still does NOT work
This section is the opposite of the rest of the guide, on purpose. It is the list of what was measured and did NOT work — and it is the same list the DzBot owner asked to have written on the screen.
The NetherNet port forwarding is not done yet
NetherNet is already enabled in the configuration (transport: both, webrtc-port: 19133, signaling: → mode: builtin) and Geyser’s warning is gone. What is missing is opening the ports on the router: UDP 19133 and TCP 19132. Measured on this machine: STUN discovery mapped the host to public port 32563 — not 19133 — so the provider’s NAT changes the port and a Bedrock client from outside the network still cannot get in through the new path.
Anyone can forge a name (in offline mode)
That is the price of turning validate-bedrock-login off so the offline bot can join. On a public server that is a real hole, and Geyser warns about it in its own configuration file.
The Bedrock bot has no XUID
Without an Xbox account the bot has no XUID: it is not an operator through Xbox and it is not in the account’s permission list. The operator comes from ops.json, and only from there.
The anticheat flags the bot (277 times)
GrimAC recorded 277 violations for DzBot — 121 Post, 67 Simulation, 39 RotationPlace, 20 FarPlace, 18 GroundSpoof, 9 AntiKB and 3 AimModulo360 — against 0 for the human player. They are the bot’s real behaviour: the order of the movement packets, the movement itself, the rotation when placing, the reach, the claim of being on the ground, the knockback and the yaw snap. The bot gets into the server, but it is not yet a client the anticheat considers legitimate. The way out is to do what a legitimate client does: the right reach, the right face, on the ground, no spurious entity action, and a human cadence.
ViaBackwards on a 1.21.2+ server is “currently unsupported”
The warning comes from GrimAC: “This setup is currently unsupported and you will experience issues with older clients using vehicles.” It does not affect the bot — it affects vehicles with old clients.
None of this is a promise of an update: it is the picture of 22/10/2026. What changes, gets written down — and the date changes with it.
And now: where to work in the panel
The guide ends here, but the work does not. These are the screens that carry it on.
- Create and start the botThe bot screen, where the host, port, version and username from step 6 are typed.
- The bot’s plugins tabWhere the server’s plugins are read and toggled — step 3 of this guide shows up here from the other side.
- API documentationTo drive the bot with a script and an access key instead of clicking.
- Network guideRakNet, NetherNet, ports and the Geyser/Floodgate diagnosis.
- Mods guideWhen the server is Forge or Fabric: what the bot can and cannot do.
- DzBot RunnerRun the bot on your own machine instead of the platform server.
- Minecraft showcaseThe DzBot demo server, to see the bot working before you touch yours.