LuckPerms: permissions and groups in 10 minutes

LuckPerms is a permissions plugin for Minecraft servers. Four commands do most of the work: lp creategroup <group> creates a group, lp group <group> permission set <permission> true grants it a permission, lp group <group> parent add <other> sets up inheritance, and lp user <name> parent add <group> puts a player in a group. You can do the same with a mouse in the web editor: /lp editor.

Why not OP#

OP is all or nothing. Many plugins grant their permissions to operators by default — CoreProtect's commands, for example, including rolling back other people's builds and purging the database. Give a moderator OP so they can kick, and they also get rollbacks, gamemode and plugin management.

Worse, a stolen account with OP is the whole server. LuckPerms gives everyone exactly what their job needs and takes it away with one command. Keep OP for yourself — or skip it entirely and grant yourself permissions through LuckPerms.

Install and get access#

1. 1

   Download and install

   The Bukkit/Paper file is on luckperms.net/download. Put it into plugins/ and restart, like any plugin: how to install a plugin.

2. 2

   Pick a storage type

   By default data lives in an H2 file database inside the plugin folder — enough for one server. Networks that share permissions pick MySQL or MariaDB in the Storage Settings section of config.yml. Decide up front: you can switch later, but it's easier to get it right once.

3. 3

   Give yourself full access

   Right after install, nobody can use LuckPerms commands. Join the server, open the console and run lp user <your name> permission set luckperms.* true. From then on you can work in game.

Four concepts#

• Permission (node) — a string like minecraft.command.ban. It can be true (granted), false (explicitly denied) or unset — which usually means the same as denied.
• Group — a set of permissions handed to players as a whole. Instead of configuring each player, you configure the group.
• Inheritance (parent) — a group or player gets all of a parent group's permissions. It chains: admin → moderator → helper → default.
• default — the group every player is in by default. It can't be swapped for another group; the developers recommend keeping it as everyone's base group.

A ready role setup#

Create groups and grant permissions#

lp creategroup helper
lp creategroup moderator
lp creategroup admin

lp group helper parent add default
lp group moderator parent add helper
lp group admin parent add moderator

lp group helper permission set coreprotect.inspect true
lp group moderator permission set coreprotect.lookup true
lp group moderator permission set minecraft.command.kick true
lp group admin permission set minecraft.command.ban true
lp group admin permission set coreprotect.rollback true

To remove a permission, use permission unset; to deny it explicitly, permission set <permission> false. The CoreProtect permissions come from its docs; the /co i inspector and log lookups are the main tools against griefers, see CoreProtect.

Put people in groups#

lp user Steve parent add moderator
lp user Steve parent remove moderator
lp user Alex parent set admin
lp user Steve parent addtemp helper 7d

• parent add adds a group to the ones the player already has and leaves their primary group alone.
• parent set replaces all of the player's groups with one (in the given context) and makes it their primary group.
• parent addtemp grants a group for a while: 7d is a week, 1mo3d13h45m is 1 month, 3 days, 13 hours and 45 minutes. Handy for a new helper's trial period.

Prefixes and weights#

lp group admin meta setprefix 300 "&c[Admin] "
lp group moderator meta setprefix 200 "&9[Mod] "
lp group helper meta setprefix 100 "&a[Helper] "
lp group admin setweight 300
lp group moderator setweight 200
lp group helper setweight 100

Weight settles conflicts: when a player has several groups or prefixes, the higher weight wins. The developers suggest leaving gaps (steps of 100, not 1) so you can slot a new group in later without renumbering everything.

Tracks: promotions and demotions#

A track is a ladder of groups for promotions. It doesn't affect inheritance — only where promote and demote move a player.

lp createtrack staff
lp track staff append helper
lp track staff append moderator
lp track staff append admin

lp user Steve promote staff
lp user Steve demote staff

If the player isn't on the track yet, promote puts them in its first group. A promotion removes the previous group on the track, so Steve doesn't end up in helper and moderator at once.

The web editor#

/lp editor sends you a link to an editor in your browser: groups, permissions, inheritance and prefixes in one view, with autocomplete. After editing, press Save (or Ctrl+S): the editor shows a command to run on the server to apply the changes. For one group use /lp group <group> editor, for one player /lp user <name> editor.

How to find the permission you need#

1. 1Check the plugin's docs — most have a permissions list.
2. 2Run /lp verbose record <name> and ask that player to run the command.
3. 3Run /lp verbose paste — LuckPerms stops recording and gives you a link to a report of every permission that was checked.

Anticheat permissions work the same way. DGuard's commands need the dguard.admin permission (see the DGuard install page). Give it to administrators only: the commands show the license state and reload the config.

In-game permissions vs panel access#

LuckPerms controls what people can do on the server. Access to your anticheat's panel is a separate thing: in DGuard the owner invites moderators and administrators by email (up to 10 seats). Moderators see server status and the punishment log with reports, filters and CSV export; administrators can also add servers and issue keys; billing stays with the owner. How to split roles in a team is covered in building a moderation team.

FAQ#