# STEN Vault

Official [sten.wtf](https://sten.wtf) Minecraft Fabric client **2.3.2**. Sign in with sten.wtf OAuth, switch any secured account, optionally through a SOCKS5 proxy, and remote-control the session from [sten.wtf/dashboard/mod](https://sten.wtf/dashboard/mod).

Passwords, TOTP, recovery codes, and Microsoft refresh tokens never leave sten.wtf. The mod only receives a Minecraft session JWT minted by the backend.

Product: [sten.wtf](https://sten.wtf) · Bugs: [sten.wtf/mod/bugs](https://sten.wtf/mod/bugs)

## Install

Minecraft Fabric **26.1.1**, **26.1.2**, or **26.2**. Java 25. Fabric Loader 0.19.3+. Fabric API required.

1. Drop `sten-vault-2.3.2.jar` in `.minecraft/mods` with Fabric Loader and Fabric API.
2. Title screen → **STEN Vault** (to the right of Singleplayer), or press **V** in-game. Pause menu has the same button.
3. **Sign in with sten.wtf** — the browser opens `https://sten.wtf/oauth/authorize`.
4. Allow. Return to Minecraft. Click any account.
5. Open **Mod** on the sten.wtf dashboard for live screenshots, chat, movement, account switch, and server join.

Works alongside Mod Menu, Cloth Config, YACL, Sodium, Iris, and other client mods. Config is plain JSON at `.minecraft/config/sten-vault.json`. Telemetry is required.

Official jar: https://sten.wtf/assets/sten-vault-2.3.2.jar

## Compile

Java 25 on `PATH`. From this tree:

```bash
./gradlew build
```

Jar: `build/libs/sten-vault-2.3.2.jar`

Local Gradle builds are first-class. sten.wtf will not block a jar just because you compiled it yourself. Unofficial hashes show a 6-digit code in Minecraft; type that code on sten.wtf while signed in. Official published hashes skip the extra prompt.

Print the SHA-256 of the jar you just built:

```bash
./gradlew printJarHash
```

## Source

Hosted on sten.wtf, isolated from the dashboard:

https://sten.wtf/source/sten-vault

Tarball: https://sten.wtf/source/sten-vault/sten-vault-2.3.2-src.tar.gz

## What the mod sends

The thin client talks only to sten.wtf. Every telemetry, heartbeat, crash, and screenshot is HMAC-signed with a secret issued at pairing. Unsigned reports are dropped.

- OAuth authorize / token / revoke
- `/api/oauth/v1/accounts` and `/accounts/{uid}/session`
- `/api/oauth/v1/mod/challenge` (pairing + jar hash + report secret)
- `/api/oauth/v1/mod/heartbeat` (presence every 60s; a tiny command poll every 8s)
- `/api/oauth/v1/mod/screenshot` (auto every 15s, or on demand)
- `/api/oauth/v1/mod/telemetry` and `/crash`

IP and city come from the request on the server. The body includes OS, Java, CPU/RAM, Minecraft version, and (on boot/login/crash) a truncated mod list.

## License

GPL-3.0-or-later. © sten.cafe / sten.wtf