# Skins

> Real faces on an offline server, and /skin from a link or somebody else's name.

Source: https://stygion.eu/docs/keystone/skins
Updated: 2026-10-10

On a server in offline mode everybody looks like Steve, because nobody asked
Mojang who they are. This module asks.

`skins.toml`, three settings and one command.

## A skin when somebody joins

```
skins.restore-on-join = true
```

When somebody joins, Keystone asks Mojang whether that name belongs to a real
account, and if it does, puts their own skin on them. **On a server in online
mode this does not happen** — the skin already arrived with the player and asking
again is work for nothing.

What goes out is the name, or the id. Nothing else.

## `/skin`

```
/skin                 # your own, by the name you play under
/skin <player name>   # somebody else's, borrowed
/skin <link>          # a picture you found
/skin reset           # back to nothing
```

The permission is `keystone.skin`.

## A picture of your own

```
skins.allow-own-picture = true
skins.signing-service = "https://api.mineskin.org/generate/url"
```

Minecraft will not wear a picture that is not signed by something it trusts, so
`/skin <link>` has to have the image signed. **MineSkin is the default**, because
it keeps the accounts for exactly that; anything else that does the same job can
replace it.

**Only the picture goes out** — no name, no id, nothing about who asked for it.
Emptying `skins.signing-service`, or turning `allow-own-picture` off, stops that
entirely and `/skin <link>` stops existing; borrowing a name and restoring a real
skin from Mojang keep working.

**Slim or classic arms** (0.2.4): `/skin <link> slim` or `/skin <link> classic`. Without either, Keystone looks at the picture itself — on a 64x64 skin a see-through fourth column of the arm means slim — and signs it that way; before 0.2.4 every picture was signed classic and a slim one wore its arms shifted. To look, the server downloads the picture once: **only an `https` link to a public address** (never this machine or a local network), no redirects, at most 256 KiB and five seconds. Anything that goes wrong means classic, as before.

## What other people see

A skin is applied the way everybody else sees that player. **Seeing your own new
skin in third person** needs the client to build the player again — on what runs
today, everybody else sees it at once and you see it after switching views.
