Lavalink YouTube Plugin: Play YouTube on Lavalink 4

Lavalink 4 plays YouTube through a plugin, not on its own: its built-in YouTube source is deprecated and should stay off. Install the YouTube source plugin (dev.lavalink.youtube:youtube-plugin), set youtube: false under lavalink.server.sources, and turn the plugin on under plugins.youtube. On our servers that was not enough: YouTube asked for a sign-in, so sign the plugin in once with a spare Google account and keep the refresh token. With release 1.18.2 the sign-in alone is not enough either (see "Version 1.18.2 and the sign-in" below). On one of our own Lavalink servers on 6 November 2026, running 1.18.2 with the unreleased fixes and a cipher server, the plugin found all 12 test songs but could start none of them before the sign-in, and started every one of the 10 tests that completed after it (15 seconds each, without a voice channel).

Why YouTube fails on a Lavalink server

The plugin's own documentation says some requests get flagged by YouTube and are asked to "sign in to confirm you're not a bot". That is what we saw on our servers. Not signed in, the plugin found every test song by search and by link, then each of its clients was refused when it tried to play:

Client [WEB] failed: This video requires login.
Client [TVHTML5_SIMPLY] failed: Sign in to confirm you’re not a bot
Client [TVHTML5] failed: This video requires login.
Client [WEB_EMBEDDED_PLAYER] failed: This video is unavailable
dev.lavalink.youtube.AllClientsFailedException: (yts.version: 1.18.2) All clients failed to load the item.

In our test, searching worked without a sign-in; playing did not. Your bot sees the song start and fail at once with a track exception.

Two other things break playback from time to time, and the plugin's documentation covers both:

The signature cipher. YouTube changes the code that unlocks its streams often. The plugin can hand that work to a remote cipher server (remoteCipher), such as the open-source yt-cipher.
The clients. The plugin talks to YouTube as several apps (WEB, MWEB, ANDROID_VR, TV and others) and tries them in the order you list. Only TV uses the sign-in for playback, and only clients marked for it can search.

The sign-in is used by the TV client, and the TV client in release 1.18.2 has a known problem: since August 2026 YouTube answers it with "The page needs to be reloaded" (issue #226 in the plugin's GitHub repository, still open on 6 November 2026). The plugin's developers merged a fix for it on 19 August 2026, a fix for streams that report no length the same day, and a fix to the cipher connections on 17 September 2026, but no release with them had come out by 6 November 2026. The plugin's README explains how to load a build of a specific commit instead of a release: the commit hash as the version, with snapshot: true. Check the releases page for a newer version first.

Set up the plugin on your own Lavalink

Add the plugin to application.yml under lavalink.plugins, with the version from the plugin's GitHub releases. 1.18.2 (27 July 2026) is the newest release on 6 November 2026. It has the TV-client problem described above, so read that section before you pick the version:

lavalink:
  plugins:
    - dependency: "dev.lavalink.youtube:youtube-plugin:1.18.2"
      snapshot: false
  server:
    sources:
      youtube: false

Turn the plugin on and give it its clients:

plugins:
  youtube:
    enabled: true
    allowSearch: true
    clients:
      - MUSIC
      - ANDROID_VR
      - WEB
      - WEBEMBEDDED
      - TV
    oauth:
      enabled: true

Optionally add a cipher server under plugins.youtube.remoteCipher (url and password), as the plugin's README describes.
Start Lavalink. The console prints a code and an address: open https://www.google.com/device, enter the code and allow access with a spare Google account. The plugin's authors warn that the account can be terminated, so never use your main one.
The console then prints OAUTH INTEGRATION: Token retrieved successfully. Store your refresh token as this can be reused. with the token in brackets. Copy it into application.yml so the node does not ask again after a restart:

    oauth:
      enabled: true
      refreshToken: "PASTE_THE_TOKEN_HERE"

Restart Lavalink. With a working token it logs YouTube access token refreshed successfully.

The refresh token opens that Google account: keep application.yml private.

On a PlayNHost Lavalink plan

The install already does the plugin part: the YouTube plugin 1.18.2 with PlayNHost fixes is in plugins as youtube-plugin-1.18.2-playnhost1.jar, Lavalink's own YouTube source is off, sign-in is switched on, and the plugin uses a cipher server we run on our own network. The fixes are the TV-client, cipher and stream-length changes that the plugin's developers merged in August and September 2026 but have not released yet. You do one thing: the sign-in.

Open your server in the panel and press Start on Console.
Find the line OAUTH INTEGRATION: To give youtube-source access to your account, go to https://www.google.com/device and enter code XXXX-XXXX, open the address, enter the code and allow access with a spare Google account.
When the console prints Token retrieved successfully, copy the token from the brackets, stop the node, and add it under oauth: in application.yml under Files, as in step 5 above. Keep the indentation.
Start the node again and check for YouTube access token refreshed successfully.

Leave plugins.youtube.remoteCipher.url as it is: the panel writes it at every start, and the address only works from our servers. A reinstall keeps your application.yml, with the token in it.

Whether YouTube serves a given song to a server is YouTube's decision, and it changes without notice. We keep the node and the plugin working; we cannot promise what YouTube allows. If you do not want YouTube at all, set enabled: false under plugins:, youtube:.

YouTube messages in the console

Message	What it means and what to do
`OAUTH INTEGRATION: To give youtube-source access to your account, go to https://www.google.com/device and enter code ...`	The plugin waits for the sign-in. Follow the steps above.
`OAUTH INTEGRATION: The device token has expired. OAuth integration has been canceled.`	The code was not entered in time. Restart the node for a new one.
`YouTube access token refreshed successfully`	The saved refresh token works.
`Refreshing YouTube access token failed`	The token no longer works, often because the account was signed out or the token was copied wrong. Remove `refreshToken`, restart, and sign in again.
`This video requires login.` or `Sign in to confirm you’re not a bot` after `Client [...] failed:`	YouTube refuses to serve the server without a sign-in. Sign the plugin in, or check that the saved token still works.
`All clients failed to load the item.`	Every client in your list was refused. The `Client [...] failed:` lines next to it give each one's reason.
`The page needs to be reloaded` from the `TVHTML5` client	The TV client problem of release 1.18.2 described above.

Other ways to get music without YouTube

The same node can play from sources that need no sign-in. On our plans Bandcamp, Twitch, Vimeo, Niconico and direct http links are on from the start. Plugins such as LavaSrc add more sites, some of which need your own API keys: How to add plugins to Lavalink.