You should add a command like ?auth (code) that gets deleted after the player auths. Many people get confused that they have to PM the bot. 

Wrong plugin.