Let's use the Realms API to download our world backup!

try_realms_api.sh

#!/bin/bash

# you need httpie (apt-get install httpie)
# you need to replace <these things> with your details
# run with 'source' to export vars to your shell for experimentation

# 1. authenticate to get an access token

auth_server=https://authserver.mojang.com
user=<your login email>
password=<your account password>
client_token=any-constant-string

# log in
response=$(http POST ${auth_server}/authenticate username=${user} password=${password} clientToken=${client_token} agent:='{"name": "Minecraft", "version": 1}')
# strip double quotes
access_token=$(echo ${response} | jq .accessToken | sed 's/"//g')

# 2. Utility: validate an access token is still valid
# http POST ${auth_server}/validate accessToken=${access_token} clientToken=${client_token}

# 3. Utility: refresh the token, getting a new accessToken without having to give password
# http POST ${auth_server}/refresh accessToken=${access_token} clientToken=${client_token}

# 4. access Realms!

# server. Note the real Minecraft client uses pc.realms.minecraft.net
realms_server=https://pc.realms.minecraft.net
# your UUID from https://mcuuid.net, I believe the trimmed version is correct
uuid=<your trimmed UUID>
# your username, e.g. notch
user_id=<your username>
# Minecraft version
version=1.11.2

# is this user allowed to access Realms? see http://wiki.vg/Realms_API
http --verbose GET ${realms_server}/mco/available "Cookie:sid=token:${access_token}:${uuid};user=${user_id};version=${version}"

Thank you very much. Btw. Do you know if there are any restrictions on how often I can request data through the API service. I am making a script that checks the players count on my Realm. I am thinking of setting an interval of one minute for each check. Wouldn’t want to get my ip banned :D

…

Den 11. feb. 2020 kl. 09.19 skrev Aaron Bell ***@***.***>: can you clarify how the "client token" works ? The value doesn't matter functionally, but it has to be there as I remember. You can set it as you like and keep it consistent for a client. The best ref I can find is https://github.com/Chris54721/OpenMCAuthenticator#client-tokens <https://github.com/Chris54721/OpenMCAuthenticator#client-tokens> Example of how I set it, https://github.com/air/minecraft-tools/blob/master/login.sh#L16 <https://github.com/air/minecraft-tools/blob/master/login.sh#L16> — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://gist.github.com/01dc784a18b8c1c9dbcb9514b38c04ee?email_source=notifications&email_token=AFL2JIADALXXEBNDXR3M2T3RCJNPZA5CNFSM4JDOFD7KYY3PNVWWK3TUL52HS4DFVNDWS43UINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQAGBVHK#gistcomment-3172981>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AFL2JIFXJ3V4IQ3LM435S5DRCJNPZANCNFSM4JDOFD7A>.

Does anyone else get dns issues?

Yep looks like the host mcoapi.minecraft.net no longer exists! We need to find where the auth server is these days.

This is now fixed, thanks to Brian McCullom who located the new server at pc.realms.minecraft.net.

Tried to translate this to python, got 403 forbidden?

username = input('starting first time setup\nenter your username:')
email = input('enter your mojang account email (this information is only sent to mojang, i never see it)\n')
password = input('enter your mojang account password\n')
clientauth = input('enter a client token (this is like a password, treat\nit like one, preferably \nno spaces or special characters)\n')
response = requests.post(url='https://authserver.mojang.com/authenticate', cookies={'username': username, 'password': password, 'clientToken': clientauth, 'agent': '{"name": "Minecraft", "version": 1}'})
print(response)

Tried to translate this to python, got 403 forbidden?

One observation, the POST to authserver (line 15 in my gist) doesn't use cookies (like you're doing). I think it's just URL params. Only the GET to Realms uses cookies.

For those who may want to know, bedrock's endpoint is: https://bedrock.realms.minecraft.net/

Are you sure? I'm getting an ENOTFOUND Error when I try to use that. pocket.realms.minecraft.net however does at least return my requests, so I'd expect this one to be the correct endpoint.

Any way to use this with the recent Microsoft changeover? App passwords or something?