Direct answer

For a single player, Invalid session usually points to the client’s authenticated login session rather than port forwarding. Close the game and launcher completely, sign out, sign back in, and launch the intended account again.

Rule out duplicate or stale launcher sessions

If multiple launchers, PCs, or account profiles are open with the same account, close them before re-authenticating. A server owner should not change server networking just because one account has a stale login token.

Check whether it affects all servers

Try another normal online-mode Java server. If the same account fails elsewhere, fix the client/account session first. If only your server fails, inspect its log for verification errors and check whether it can reach account/session services.

Proxy network check

A Velocity setup must have consistent authentication and player-forwarding settings. The proxy can authenticate players while backend servers run offline mode only when modern/legacy forwarding is configured and the backends are protected from direct access.

Avoid deleting player data

Authentication errors happen before normal player data is loaded. Deleting playerdata files, changing the world, or allocating more RAM does not repair an expired login session.

Distinguish credentials from transport
  1. If only one legitimate account fails, fully sign out and back into the official launcher and retry without alternate accounts running simultaneously.
  2. If every account fails at the same time, inspect the server’s authentication settings and upstream service status instead of asking all players to reinstall Minecraft.
  3. Do not disable online-mode on an internet-facing standalone server simply to bypass an authentication error.

Official references

These references were checked while preparing this fix. Version-specific behavior can change, so use the project documentation for your exact release when a detail differs.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000