Description

Keychain

Switch Minecraft accounts in-game without restarting. A Keychain button is added to your title screen and pause menu. Click it, pick Add Online, and the real Microsoft sign-in page opens in your browser. Sign in normally — email, password, 2FA — and your account appears in the list. Click any saved account to switch to it instantly.

Features

🔑 One-click account switching — click any saved account in the list, you're switched. No restart.
🌐 Real Microsoft login — opens login.microsoftonline.com in your browser. Same form Microsoft uses everywhere. Email, password, 2FA, all official.
👤 Offline accounts — pick a username, switch immediately. Same OfflinePlayer: UUID derivation vanilla uses.
🔒 Encrypted at rest — your saved tokens are AES-GCM-encrypted with a key tied to your machine. Anyone who copies your .minecraft folder gets unreadable data.
🚫 Zero telemetry — only talks to Microsoft and Mojang's official endpoints. No phoning home, no analytics.
⚡ Tiny — ~50 KB jar. No bundled browser, no native libs.
🧹 Clean UI — top-left button, two big actions, click-to-switch, right-click-to-remove.

How it works

Keychain uses the OAuth 2.0 Authorization Code flow with PKCE — the same flow MultiMC, Prism Launcher, and Auth Me use. When you click Add Online:

Keychain starts a tiny local HTTP server bound to 127.0.0.1 on a random free port.
Your default browser opens to the official Microsoft sign-in page.
You sign in with your real credentials. 2FA and security keys work normally.
Microsoft redirects back to http://localhost:<port>/callback.
Keychain captures the auth code, exchanges it through the standard Microsoft → Xbox Live → XSTS → Minecraft Services chain.
Your account appears in the list, encrypted to disk.

The local server only exists during the ~5-minute sign-in window and shuts down immediately afterwards.

Privacy

🔐 AES-GCM encryption of <gamedir>/config/account-switcher.json using a key derived from your OS user + machine name. Tokens are unreadable on any other machine.
🚷 No tokens in logs. latest.log and crash reports never contain access tokens, refresh tokens, or auth codes.
🛡️ PKCE + state parameter — protects against code interception and CSRF.
🌐 HTTPS-only outbound traffic to: login.microsoftonline.com, user.auth.xboxlive.com, xsts.auth.xboxlive.com, api.minecraftservices.com. Nothing else.
🔒 Loopback-only local callback server (127.0.0.1, never reachable over your network).

Installation

Install Fabric Loader for Minecraft 26.1.x.
Download Fabric API and drop it into %APPDATA%\.minecraft\mods (Windows) / ~/Library/Application Support/minecraft/mods (macOS) / ~/.minecraft/mods (Linux).
Drop the Keychain jar into the same folder.
Launch Minecraft. Keychain button is at the top-left of the title screen and pause menu.

Compatibility

✅ Minecraft 26.1, 26.1.1, 26.1.2 (Fabric)
✅ Java 25
✅ Client-side only (don't put it on your server)
⚠️ Mid-server account switching may kick you — switch from the title screen for cleanest behaviour.
⚠️ Skin doesn't refresh on a server you're already connected to. Disconnect and reconnect after switching.

FAQ

Why does the Microsoft consent screen say "Auth Me for Minecraft"? Keychain ships with a public Azure App ID registered by Auth Me (axieum), used by ~9.6 million players. If that ever gets revoked, Keychain has a built-in Use custom Azure ID fallback to paste your own.

Is this safe for my Microsoft account? Yes. The mod opens the real login.microsoftonline.com — you're signing in to Microsoft directly, not to me. Verify the URL bar. Same flow as the official Minecraft launcher and every major third-party launcher.

Will my token file leak if I share my .minecraft folder? No. The file is AES-GCM-encrypted with a per-machine key. Unreadable elsewhere.

Can I sign in to multiple accounts and switch? Yes — that's the entire point. Add as many as you want, click any one to switch.

Does it work on servers? Yes for switching from the title screen / pause menu before joining. Switching mid-game on a server will likely get you kicked because the protocol session changes.