Authentication
One browser login covers everything. The session is captured once and both tool layers use it from then on.
Why the browser #
The Minehut dashboard sits behind Cloudflare, and its session system has changed several times over the years. A real browser login solves the challenges that come with that, in the same way a human opening the panel would. The captured session then powers the fast API tools.
The login flow #
- Ask your AI to call
browser_login_panelwith your Minehut email and password. - A browser opens the dashboard and fills the login form automatically.
- A Cloudflare challenge or 2FA prompt may appear. Call
browser_wait_manualso you can finish it by hand. - The session token is captured and stored in
~/.minehut-mcp/session.jsonwith file permissions 600. - All
minehut_*API tools become active. The browser stays available for anything the API does not cover.
MINEHUT_HEADLESS=0 in the client
config for the first login. Cloudflare challenges are easier to solve when you can see the
window.
What gets stored #
| Path | Contents |
|---|---|
~/.minehut-mcp/session.json |
Captured token and session id, permissions 600 |
~/.minehut-mcp/browser-profile |
Persistent browser profile holding the dashboard cookies, so later starts stay logged in |
~/.minehut-mcp/shot-*.png |
Screenshots taken with browser_screenshot |
Without the browser #
The API layer also accepts a session set directly through environment variables:
export MINEHUT_TOKEN="your-token"
export MINEHUT_SESSION_ID="your-session-id"Tokens found in the dashboard's localStorage under keys such as
minehut_auth_token and minehut_session_id are picked up
automatically by browser_wait_manual and by the login flow.
When the session expires #
Minehut sessions expire on login, logout or long inactivity. Rejected sessions return a
clear error from the API tools that tells the AI to re-run browser_login_panel.
The stored browser profile usually makes the next login a single click, because Cloudflare
already trusts the cookies.