Manage Minecraft operators, permissions and the whitelist

Minecraft operator status, plugin permissions and CloudExa panel access are separate. Give a moderator the commands their role needs without sharing your hosting password. These instructions cover a Java server running Paper or Purpur; other server types can use different permission systems.

Keep a recovery route

Sign in to the game panel and check that you can open the server's Console. Keep access through your own panel account while testing player permissions. A player who cannot run a command in-game does not need your billing or panel login.

Record the existing roles before changing them. Back up your permissions plugin's data and any external database it uses. On a public server, make one change at a time and test with an ordinary player account so operator privileges do not hide missing permissions.

Add or remove an operator

Enter these examples in Console without a leading slash. Replace PlayerName with the correct Java account name:

op PlayerName
deop PlayerName

Use op only for someone you trust with broad administrative access. Remove it with deop when they no longer need that role. A plugin can grant commands independently, so removing operator status may not remove every permission. Check both sources of access.

Grant a specific permission with LuckPerms

First install the compatible LuckPerms plugin and read the permission documentation for the command you want to allow. In Console, this example grants one player the vanilla ban-command permission:

lp user PlayerName permission set minecraft.command.ban true

To remove that explicit assignment, use:

lp user PlayerName permission unset minecraft.command.ban

Unsetting an assignment allows inherited group permissions to apply again; it does not guarantee a denial. Check the player's groups and contexts if access remains. Use the plugin developer's exact permission node. Avoid broad wildcard grants such as * for routine staff roles. Keep LuckPerms administration itself restricted to trusted administrators.

Control who can join

A whitelist controls admission rather than moderation commands. Operators can bypass normal whitelist admission, so test with a non-operator account. Add your own account before enabling it:

whitelist add PlayerName
whitelist on
whitelist list

Remove a former member with whitelist remove PlayerName. Do not assume removing a name disconnects an existing session immediately; check connected players and the server's whitelist enforcement setting. If you edit the whitelist file manually, keep a copy and follow the server's reload procedure instead of changing it during an active write.

When staff leave or commands fail

Review operator status, permission groups, plugin-specific access and panel teammate permissions. These controls do not revoke one another. For proxy networks, confirm which server handles the command before editing permissions. Send support the command, exact error, server ID and the relevant permission node. Redact tokens and private editor links from screenshots.

Further reading: LuckPerms usage, Paper permissions and vanilla player data files.