FAQ

Do players have to do anything?

No. There is no captcha, no check screen and no reconnect. A player on a home or mobile connection joins exactly as before.

Do I need an API key or a subscription?

No. Kalkan is one purchase, and your download carries your license key. Team Atlantis builds and updates the data file, and every check is answered from memory on your proxy, so there is no quota and no per-check fee.

Can I run it on more than one proxy?

Yes. One license covers two proxies. If you move to a new machine there is nothing to do: once the old proxy has been offline for 24 hours, the new one takes its place. For more proxies at once, open a ticket in our Discord.

My license key leaked. What do I do?

Open kalkan.teamatlantis.xyz/reset, enter your key and click Get a new key. Then download Kalkan from BuiltByBit within one hour with the account you bought it with: that download proves it’s you. The page shows your new key; run kalkan license <new-key> in the proxy console, or put the new jar in and restart. The old key, and every copy of it, stops working within 30 minutes.

The console says Kalkan is NOT active.

Run kalkan license to see why: no key, an unknown or revoked key, the proxy limit, or the license server could not be reached. To set the key from your purchase: kalkan license <key>. Until the license is active, Kalkan checks nobody and kicks nobody.

Will it kick my real players?

Home and mobile connections are never blocked by a connection-type rule. Start in monitor mode: for a day, Kalkan only records who it would kick, and /kalkan report shows the numbers before you switch. Regulars with 3 clean days in the last 60 may also come in through a VPN, and the allow list takes names, IPs, CIDR ranges and networks.

To check one case: /kalkan ip <ip> or /kalkan player <name>.

Does it stop every bot?

It stops the bots that connect from datacenters, clouds, VPNs and Tor: cheap, throwaway addresses, and where most bot floods come from. On a live network before Kalkan was switched on, 135 such addresses made 27% of all 28,001 login attempts in eight days. A bot that connects through somebody’s home line looks like a normal player to an address check.

My players connect through TCPShield or another DDoS-protection proxy.

Turn on haproxy-protocol in velocity.toml and PROXY protocol at your provider, so Velocity, and Kalkan, see the player’s real IP. Without it every player looks like your provider’s datacenter.

Does it work with Bedrock players?

Yes. Floodgate players (names starting with floodgate-prefix, default .) are checked like everyone else. Set bedrock-check: false to let them all in.

Which Minecraft versions?

Every version your Velocity accepts. The clickable dialog menu needs Minecraft 1.21.6+ and packetevents on the proxy; everyone else gets the same menu in chat.

Does a join wait for anything?

No. The decision comes from memory in about 0.3 µs. The data file downloads in the background.

What if Team Atlantis’s data server is down?

Kalkan keeps using the last data file on disk and tries again at the next refresh. If no data file was ever loaded, it lets everyone in. The license check is just as patient: a key that was accepted in the last 7 days keeps working while the license server can’t be reached.

Does Kalkan send my players’ data anywhere?

No. A login is decided on your proxy without any outside request. Kalkan contacts Team Atlantis only for the license check and the data download, and those send your license key, a random id for this proxy, the Kalkan version, the proxy’s player count and port. The Discord webhook is used only if you set one.

Can I change the kick message?

Yes. kick-message and country-kick-message in config.yml are MiniMessage, with placeholders for the type, the fix, the IP, the country, the network and the player name. See the config.yml reference.

Does it work with my login plugin?

Yes. Kalkan decides in Velocity’s pre-login step, before any login or auth plugin, so those keep working for everyone Kalkan lets through.