FiveM server.cfg explained: convars, OneSync and ACE

server.cfg is the only configuration FXServer has. It sets the ports, the player cap, the licence key, the name in the server list, which resources start and in what order, and who is allowed to type which command. It is read once, top to bottom, when the server starts - so order matters, a missing closing quote silently eats everything after it, and a convar a resource reads at start will not change until that resource restarts. This post goes through the file the way the server does.

Where the file lives and how it is read#

FXServer is started with the file named on its command line:

$ ./run.sh +exec server.cfg

Everything in the file is a console command. There is no special syntax, no sections and no indentation rules: each line is executed exactly as if you had typed it into the server console. # starts a comment. Values containing spaces need double quotes, and a quote you forget to close makes the parser swallow the rest of the line, which is why a perfectly valid-looking file can fail with an error pointing at a line forty rows further down.

Nesting is supported and worth using. exec permissions.cfg at the bottom of server.cfg pulls in a second file, which is the sane place to keep the list of admin identifiers so you can share your server.cfg when asking for help without handing out your admin list.

If you run txAdmin, it keeps the server data in its own folder and edits server.cfg through its CFG Editor page. Editing the same file in a file manager while txAdmin has it open means one of the two copies wins. Pick one place and stay there.

The lines every server needs#

This is the default template, trimmed to the parts that are not optional, with the values you would actually set:

endpoint_add_tcp "0.0.0.0:30120"endpoint_add_udp "0.0.0.0:30120"sv_hostname "^2Northside RP ^7| ^3Whitelisted ^7| ^1ESX"sv_maxclients 48sv_licenseKey "cfxk_xxxxxxxxxxxxxxxxxxxxx_xxxxxx"sv_scriptHookAllowed 0sv_endpointprivacy truesets locale "en-GB"sets tags "roleplay, esx, whitelist, europe"load_server_icon logo.pngset mysql_connection_string "mysql://user:pass@host/db?charset=utf8mb4"ensure oxmysqlensure ox_libensure es_extendedexec permissions.cfg

endpoint_add_tcp and endpoint_add_udp both point at the same port number, and both are needed. The UDP side carries the game traffic. The TCP side is an HTTP server: it hands clients the resource files on first join and answers /info.json, /players.json and /dynamic.json, which is how every server tracker in existence knows your player count. A server where only TCP is reachable loads forever at the connecting screen; a server where only UDP is reachable never gets past downloading resources. Game server ports explained covers why the two halves fail differently.

0.0.0.0 means "every address on this machine" and is almost always right. Change it only if the machine has several interfaces and you know which one you want.

sv_hostname accepts colour codes: ^1 red, ^2 green, ^3 yellow, ^4 blue, ^5 cyan, ^6 pink, ^7 white, ^8 orange, ^9 grey. Use two at most. A hostname that is mostly punctuation is not memorable and the server list search is on plain text.

sv_licenseKey is your own key from the Cfx.re portal. It is issued to you, not to your host, and it is bound to the address the server runs on - moving to another host or another IP means reissuing it rather than copying it across. FXServer will not start without a valid one, and it says so clearly in the console.

set, sets and setr: three different words for a variable#

This trips up everyone once. FiveM has three commands that look identical and go to different places.

A script reads any of them with GetConvar('name', 'default') or GetConvarInt('name', 0). The rule is simple and absolute: anything secret uses `set`. A database password behind sets is published to the server list, where it is scraped within minutes.

set mysql_connection_string "mysql://user:pass@host/db"   # privatesets sv_projectName "Northside RP"                        # publicsets sv_projectDesc "Serious roleplay, whitelist on Discord"setr voice_defaultRadius 25.0                             # clients read it

sets locale takes a locale identifier such as en-GB or de-DE; the default template ships the placeholder root-AQ, which is Antarctica, and leaving it is a small sign that nobody read the file. sets tags is a comma-separated list used by the server list filters, and it is the cheapest discovery you get.

load_server_icon wants a 96 by 96 PNG sitting next to server.cfg. Any other size is rejected, usually without a message you will notice.

OneSync and player slots#

Base GTA networking tops out at 32 players. OneSync is Cfx.re's replacement for it, and everything above 32 slots depends on it:

set onesync onset onesync_population trueset onesync_forceMigration truesv_maxclients 64

onesync on is the current form and covers what older guides call Infinity. legacy is the older, lower-capacity mode, and off puts you back on the 32-player ceiling. With OneSync on, FXServer will accept slot counts far beyond anything sensible; the number you should set is decided by your CPU and your resource list, not by the limit.

onesync_population controls whether the server spawns ambient traffic and pedestrians. Roleplay servers usually leave it on, then spend a year complaining about entity counts. Turning it off removes a large slice of network and CPU load at the cost of an empty city, and several serious servers do exactly that and spawn their own traffic where it matters.

onesync_forceMigration moves entity ownership away from a player who leaves rather than deleting the entity. Without it, a vehicle someone was the owner of can vanish when they disconnect.

Changing OneSync settings requires a full server restart, not a resource restart. So does sv_maxclients. And raising the slot count on a server that is already at 100% of its CPU share only means more people watching it be slow - CPU vs RAM for game servers is the honest version of that conversation.

Game build, script hook and pure mode#

sv_enforceGameBuild 2802sv_scriptHookAllowed 0sv_pureLevel 1

sv_enforceGameBuild pins every client to a specific GTA Online update. It matters because vehicles, weapons, map areas and clothing added in a given DLC only exist on clients running at least that build. If a custom vehicle uses assets from a newer build than you enforce, it will be invisible or crash the client. Common values include 1604 (the base build), 2060, 2189, 2372, 2545, 2612, 2699, 2802, 2944, 3095 and later. The list grows with every Rockstar update, so check the current Cfx.re documentation rather than copying a number from a forum post. Raising it forces every player to download the newer game data from Rockstar, which is a one-off delay for them and worth announcing.

sv_scriptHookAllowed 0 blocks ScriptHookV-based client menus. Leave it at zero. There is no roleplay server that wants it on.

sv_pureLevel 1 refuses connections from clients with modified game files; 2 is stricter and also blocks graphics modifications. Pure mode is a blunt instrument: level 2 will reject perfectly innocent players running visual mods, and it is not an anti-cheat. Start at 0 or 1 unless you have a reason.

sv_endpointprivacy true keeps player IP addresses out of the server's public output. There is no reason to have it off.

Starting resources#

ensure oxmysqlensure ox_libensure es_extendedensure ox_inventoryensure pma-voice

ensure starts a resource, or restarts it if it is already running. start only starts. stop and restart do what they say, and refresh rescans resources/ for folders that were not there when the server booted - a new resource always needs refresh before ensure will find it.

Order in the file is load order, and load order is dependency order. The database bridge first, then shared libraries, then the framework, then everything that talks to the framework. A job resource that starts before the core gets nil when it asks for the shared object and then quietly does nothing for the rest of the session, with no error. Which framework goes in the middle of that list, and what each one needs, is covered in FiveM frameworks compared.

A resource is only found if its folder contains fxmanifest.lua. Folders wrapped in square brackets, like [core] or [jobs], are scanned as containers rather than treated as resources, and the nesting can go several levels deep. ensure always takes the resource name, never the path.

ACE permissions: who can do what#

FiveM's permission system is two commands. add_principal says that one thing inherits from another. add_ace says that a principal is allowed or denied an object.

add_ace group.admin command allowadd_ace group.admin command.quit denyadd_ace group.mod command.kick allowadd_ace group.mod command.ban allowadd_principal group.admin group.modadd_principal identifier.license:8e1f0c2a4b6d8e0f2a4b6c8d0e2f4a6b8c0d2e4f group.adminadd_principal identifier.discord:216735154273419264 group.mod

Objects are hierarchical on dots, so allowing command allows every command.something, and a later deny on a specific one wins. Principals can be identifiers, groups, or resources - resource.mycoolscript is a real principal, which is how a resource is granted the right to run privileged commands itself.

Identifier types you can use as principals: license, license2, steam, discord, fivem, xbl, live and ip. license is the one to use for a permanent admin: it is stable, it does not require Steam to be running, and it is printed in the console when the player joins. steam identifiers only exist if you have set a Steam Web API key with set steam_webApiKey, and discord only if the player has Discord running. Never use ip.

Resources check these with IsPlayerAceAllowed(source, 'something'), and the object does not have to be a command - frameworks define their own, such as an ace for opening an admin menu. The true argument at the end of a RegisterCommand call is what makes a command ACE-restricted in the first place; without it, the command is open to every player on the server.

Two things people get wrong. First, group.admin has no meaning until you grant it something: it is an ordinary name, not a built-in role. Second, txAdmin keeps its own separate admin list, so adding somebody to txAdmin does not give them in-game ACE permissions, and granting ACE permissions does not let them into txAdmin. They are two systems and you maintain both. The general argument for keeping those lists short is in subusers and least privilege.

RCON, and why to leave it off#

FXServer supports the old Source-style RCON protocol through rcon_password. The default template ships it commented out, and that is where it should stay. RCON on FiveM sends the password in the clear over UDP on the same port as the game, and everything you would use it for - console, restarts, player management - is already in your panel console or txAdmin. If you genuinely need it, set a password that exists nowhere else and read RCON, safely first.

sv_master1 "" removes the server from the public server list. Use it for a development server you do not want strangers finding, and remember you have set it, because "my server does not appear in the list" is otherwise a long evening.

Troubleshooting a config that will not start#

Nothing happens after a line you edited. A missing closing quote. The parser consumed the rest of that line, and if the quote was at the end of the file, the last several settings never ran. Search the file for an odd number of quotes.

The console says the licence key is invalid. The key is wrong, has been revoked, or is being used on a different address. Keys are tied to the address they run on, so a server that moved needs the key reissued in the Cfx.re portal, not copied.

Could not find resource. The folder name does not match the ensure line, the folder has no fxmanifest.lua, or the folder was added after the server booted and nobody ran refresh. Case matters on Linux.

Players sit on "Loading screen" forever. Usually a resource erroring during the spawn or character flow. Watch the console while someone joins; the last resource to print before the silence is your candidate. Reading the console is the skill this needs.

Players cannot connect at all but the server is running. UDP is not reachable. Confirm both endpoint_add_tcp and endpoint_add_udp are present and that the port is the one your host allocated to you.

Clients are told the server is on a different game build. sv_enforceGameBuild does not match what their game has. They need to let GTA update, or you need to lower the enforced build.

The server ignores `sv_maxclients` above 32. OneSync is off. Set set onesync on and restart the whole server.

On RE:NODE, the FiveM plans come with two port allocations - one for the game endpoint and one for txAdmin's web interface - and you can add more on the Network tab if a resource needs its own. The Startup tab holds the launch variables, server.cfg itself is editable in the browser with syntax highlighting or over SFTP, and the console is unfiltered, which is the only way the loading-screen problem above ever gets solved. A weekly restart from the Schedules tab keeps entity counts honest; restart schedules that help has the reasoning.

FAQ#

Do I need both endpoint_add_tcp and endpoint_add_udp?

Yes, on the same port. UDP carries the game, TCP serves the resource downloads and the JSON endpoints the server list reads. With one missing, the server appears to work right up to the point where a player tries to join.

What is the difference between set, sets and setr?

set is server-private, sets is published to the server list, setr is replicated to connected clients. Database passwords and API keys always go in set. Anything you would be happy to see on a tracker site can be sets.

How many players can a FiveM server hold?

Thirty-two without OneSync. With set onesync on the software ceiling is far higher than anything you should attempt, and the real answer is whatever your CPU share and resource list support - most servers find their limit somewhere between 48 and 128 with a normal roleplay resource load.

How do I make someone an admin?

Add their license: identifier as a principal of a group, and grant that group the aces you want. Their licence identifier is printed in the console when they join. If they also need txAdmin, add them there separately - the two permission systems do not talk to each other.

Why does my change to server.cfg have no effect?

Convars are read when a resource starts. Editing the value and restarting nothing changes nothing. Restart the resource that reads it, and for sv_maxclients, OneSync and endpoints, restart the whole server.

Should I turn RCON on?

No. It is an unencrypted protocol from a previous decade and every job it can do is already done by the panel console and txAdmin. Leave rcon_password commented out.