AXOLICLIENT

The launcher signs in the same way the official launcher does. It uses its own Microsoft (Azure) app registration, set up for personal Microsoft accounts, with the standard Xbox Live and Minecraft services. It requests only the XboxLive.signin and offline_access permissions.

1. When you choose Add account, the launcher opens Microsoft's own sign-in page (login.microsoftonline.com) in a separate, sandboxed window with a fresh, empty browser session. You type your email and password only on Microsoft's page. The launcher never sees, handles or stores your password.
2. Sign-in uses the OAuth 2.0 authorization code flow with PKCE and a random state value. When Microsoft redirects back, the launcher reads the one-time code and closes the window.
3. The launcher exchanges that code with Microsoft for an access token and a refresh token.
4. The Microsoft token is exchanged with Xbox Live (user.auth.xboxlive.com), then XSTS (xsts.auth.xboxlive.com), and finally with Minecraft services (api.minecraftservices.com) for a Minecraft access token.
5. The launcher reads your Minecraft profile (username and UUID) to confirm that the account owns Minecraft: Java Edition, then starts the game with that token, like the official launcher.

If the account has no Xbox profile, isn't allowed on Xbox Live, or doesn't own the game, the launcher shows a clear message and stops.

On your computer

Accounts are saved in %APPDATA%\.axoli-launcher\accounts.json on your own PC. For each account it keeps:

Your password is never stored anywhere. Tokens are only ever sent to Microsoft, Xbox Live and Mojang. They are never sent to Axoli's own servers. You can remove an account in the launcher at any time, which deletes its saved tokens. You can also revoke the launcher's access from your Microsoft account's privacy settings.

On the Axoli service

Friends and cosmetics are provided by the Axoli service. To prove who you are, the launcher and the mod use Mojang's standard server-join check (the same check every Minecraft server uses). The service asks Mojang whether you joined and never receives your Microsoft or Minecraft tokens. The service keeps:

• your Minecraft username and UUID, and when you were last seen;
• the cosmetics you picked, so other Axoli players can see them;
• your friends, friend requests and team membership;
• a location (server and position) only if you turn on location sharing, held in memory and shared only with your friends.
• the cosmetics you own, your Axoli coin balance and a log of coin changes (packs bought, cosmetics bought, refunds), and, if you link it, your Discord account's ID and name;
• profiles you share as a code, for 30 days or until you delete the code.

The game and launcher reach the service over an encrypted connection (https://api.axoliclient.com). That address runs through Cloudflare, which protects it from attacks and, like any network in between, sees your IP address and the time of each request. Your IP address is only used, in memory, to limit how fast one address can send requests. It is not stored (the one exception: a forged payment notification sent to the service is logged with the address it came from).

Buying Axoli coins

Coin packs are sold by Tebex, which is the merchant of record: Tebex handles the payment, your payment details, receipts, taxes, refunds and chargebacks under its own privacy policy. Axoli never sees your card or PayPal details. Axoli only receives your Minecraft username and UUID and which pack you bought, so it can add the coins to your account. Your IP address is passed to Tebex when you open a checkout from the game or launcher, for its fraud checks.

Axoli does not sell data, show ads or use the data for anything other than these features. To have your data on the Axoli service deleted, contact us (below).

Axoli is a free, independent project. It is not affiliated with or endorsed by Mojang Studios or Microsoft. It does not sell or unlock Minecraft: every player needs their own copy of Minecraft: Java Edition.