Palworld admin commands, RCON and the REST API

Administering a Palworld dedicated server comes down to one password and three ways of using it. Set AdminPassword in PalWorldSettings.ini, and you can type /AdminPassword <your password> in the in-game chat to unlock the command set, connect a Source RCON client to port 25575, or make HTTP calls against the REST API on port 8212. The command list is short - about a dozen entries, no cheat commands, no item spawning - but it covers announcements, kicks, bans, teleports, forced saves and a countdown shutdown, which is everything an automated restart script needs. This post covers all three routes, the player ID formats that decide whether a kick works, and the quirks that make Palworld's RCON different from every other game's.

Setting the admin password#

One line in the config, with the server stopped:

OptionSettings=(...,AdminPassword="7Tz-quay-brindle",ServerPassword="...",...)

Three rules for the value. It must not contain a comma, a closing bracket or a double quote, because the whole config is one comma-separated tuple inside brackets and those characters end it early. It must not be the same as ServerPassword, which is the join password that every player knows. And it is stored in plain text in a file that anyone with file access can read, so treat file-manager and SFTP access as admin access - subusers and least privilege is the shape of that problem on a panel. The rest of the config file is covered key by key in Palworld server settings.

To use it in game, press Enter to open chat and send:

/AdminPassword 7Tz-quay-brindle

The server replies that you are now an admin. That state lasts for the session and is lost when you disconnect. There is no admin list, no per-player admin flag and no way to grant one person admin without handing them the password. If somebody leaves the group, change the password and restart.

The command list#

In chat every command is prefixed with /. Over RCON and in most panel consoles you send the same word without the slash. The list is short and deliberately so.

That is the whole thing. There is no command to spawn an item, change the weather, set the time, promote a player or edit a guild. Anything beyond the list above needs a server-side mod, and Palworld's modding scene is much thinner than Valheim's or Minecraft's, so plan around the built-in set rather than assuming a plugin exists.

Two of them deserve attention. Shutdown 60 "Restarting for the weekly update" is the one you build automation on: it warns everyone, waits, saves and exits cleanly. DoExit does none of that, and on a game that writes a large world file continuously it is how you end up with a truncated save. Use Save, then Shutdown, and keep DoExit for a server that has stopped responding.

Broadcast has a long-standing quirk: in several builds it treats the message as a single token and drops everything after the first space when sent over RCON. If your announcements arrive as one word, substitute underscores for spaces as a workaround, or send the message through the REST API's announce endpoint instead, which does not have the problem.

Player IDs, and why your kick did nothing#

ShowPlayers returns comma-separated text with a header row:

name,playeruid,steamidOdin,1234567890,76561198012345678Freyja,0987654321,76561198087654321

Those are two different identifiers. The playeruid is the game's internal handle and changes meaning between builds; the steamid is the 17-digit SteamID64 that everything else in the Steam ecosystem uses. Current builds expect the platform-prefixed form for kicks and bans:

BanPlayer steam_76561198012345678KickPlayer steam_76561198012345678

Passing a bare SteamID64, or the playeruid, is the most common reason a ban appears to succeed and the player walks straight back in. If the command returns nothing at all, that is also usually the ID format rather than a permissions problem. Copy the value out of ShowPlayers rather than asking the player for it, because a name with a comma or a non-Latin character in it will not survive the CSV either.

Turning on RCON#

RCON is the Source protocol: a TCP connection, one password, plain text both ways. Two keys switch it on, and the admin password is the RCON password.

OptionSettings=(...,RCONEnabled=True,RCONPort=25575,AdminPassword="...",...)

Restart, then talk to it. Any Source RCON client works. mcrcon and gorcon's rcon-cli are the two usually reached for:

$ rcon-cli --address 203.0.113.10:25575 --password '7Tz-quay-brindle' "ShowPlayers"$ mcrcon -H 203.0.113.10 -P 25575 -p '7Tz-quay-brindle' "Save" "Info"$ rcon-cli -a 203.0.113.10:25575 -p '7Tz-quay-brindle' \    "Broadcast Server_restarts_in_five_minutes"

Palworld's implementation is not quite standard, and it is worth knowing which oddities are yours and which are the game's:

• Replies can arrive one packet behind, so a client may print the previous command's answer. Clients written for Minecraft usually cope; very simple ones do not.
• Non-ASCII player names come back mangled in some builds, because the response is not encoded the way the protocol expects. It affects display, not the command.
• Shutdown may not return a reply at all, since the server is on its way out. A client that waits for one will appear to hang. That is expected.

There is one more thing that surprises people arriving from other games: Palworld does not read commands from standard input. Typing ShowPlayers into a panel console does nothing on its own, because the game never looks there. Some panel images bridge the console to RCON so it appears to work; if yours does not, RCON or the REST API is the only route. That also means an automated "send this console command" task is really an RCON call under the hood.

RCON has no encryption and no per-user accounts, so it should never be reachable from the open internet. Bind it behind a firewall rule, or reach it through an SSH tunnel from the machine you administer from. RCON safely covers the minimum, and firewall rules that matter covers the rule itself. On a panel you control which ports exist on the Network tab, and RCON is one of the allocations rather than something you can quietly forget about.

The REST API#

Newer builds ship an HTTP admin API, which is easier to automate against than RCON and does not have the broadcast quirk. Two keys:

OptionSettings=(...,RESTAPIEnabled=True,RESTAPIPort=8212,AdminPassword="...",...)

Authentication is HTTP Basic with the username admin and the admin password as the password. The endpoints live under /v1/api/:

$ curl -u admin:'7Tz-quay-brindle' http://203.0.113.10:8212/v1/api/metrics$ curl -u admin:'7Tz-quay-brindle' -H 'Content-Type: application/json' \    -d '{"message":"Restarting in 5 minutes"}' \    http://203.0.113.10:8212/v1/api/announce$ curl -u admin:'7Tz-quay-brindle' -H 'Content-Type: application/json' \    -d '{"userid":"steam_76561198012345678","message":"Griefing"}' \    http://203.0.113.10:8212/v1/api/ban

GET /v1/api/settings is the most useful call on the list and almost nobody uses it. It returns the settings as the server parsed them, which is the one reliable way to find out that your config file has a syntax error and every rate quietly reverted to 1.0. Diff it against what you think you wrote after any config change.

GET /v1/api/metrics returns the server's frame rate and frame time alongside the player count. A healthy Palworld server sits at its target frame rate; a number that sags in the evening while memory climbs is the signal described in why your Palworld server needs more memory than you think, and it is a better early warning than waiting for players to complain about rubber-banding.

Bans, the ban list and the global list#

A ban is written to a plain text file next to the saves:

Pal/Saved/SaveGames/banlist.txt

One entry per line, in the same prefixed form the commands take. You can edit it by hand with the server stopped, which is how you unban someone on a build that has no UnBanPlayer, and how you seed a new server with an existing list. Edits made while the server is running are liable to be overwritten, because the server rewrites the file when it bans someone.

There is also a network-wide list. BanListURL defaults to Pocketpair's published ban list, and the server fetches it at startup. Two practical consequences: your server inherits bans it did not make, and if the URL is unreachable the server logs a failure and carries on. You can point BanListURL at a plain text list you host yourself, in the same format, to share one ban list across several servers - useful if you run more than one and want a griefer gone from both.

Bans are by platform account, not by address. Someone with a second Steam account is not stopped by a ban, and nothing in the base game does IP bans. If a server is being targeted, ServerPassword is a more effective tool than the ban list.

Automating the boring parts#

Everything worth automating on a Palworld server is a Save, a warning, and a Shutdown. A restart every night keeps memory flat, and the announcement is what stops people losing a base assault to it.

# 23:55 - five minute warning, save, then a clean countdown shutdown$ rcon-cli -a 127.0.0.1:25575 -p "$RCON_PASS" "Broadcast Nightly_restart_in_5_minutes"$ sleep 240$ rcon-cli -a 127.0.0.1:25575 -p "$RCON_PASS" "Save"$ rcon-cli -a 127.0.0.1:25575 -p "$RCON_PASS" "Shutdown 60 Nightly_restart"

Keep the password in an environment variable rather than in the script - environment variables and secrets explains why that is not just tidiness. If you are writing the cron line yourself, cron expressions explained has the five fields; on a panel, the Schedules tab takes the same expression and runs ordered tasks with delays between them, so the warning, the save and the power action become three steps of one schedule. Scheduled tasks worth having lists the handful that are actually worth the trouble.

One thing not to automate: a restart on a timer with no player check. A countdown shutdown at 23:00 lands in the middle of somebody's evening at least once a month. Either pick an hour nobody plays, or drive the restart from the player count that /v1/api/metrics gives you.

Troubleshooting#

RCON refuses the password. The password in the ini contains a comma, a bracket or a quote and the config parser stopped early, so the server is running with an empty admin password. Check GET /v1/api/settings, or look at the config again.

RCON connects, commands return nothing. Usually the off-by-one reply behaviour. Send the command twice and see whether the first answer arrives on the second call; if so, it is the client, not the server.

The port is open but nothing answers. RCONEnabled=True only takes effect after a restart, and it is a TCP port while the game port is UDP, so a firewall rule copied from the game port will not cover it. Game server ports explained has the general shape of this mistake.

A banned player keeps coming back. Wrong ID form, a second account, or the ban list being rewritten under you. Check banlist.txt after the ban and confirm the line is there in steam_<id> form.

`/AdminPassword` says nothing in chat. The password does not match, or you are on a build where the chat reply is suppressed. Try /Info straight after: if you get a version string back, you are an admin.

Shutdown warnings never reach players. The broadcast-splits-on-spaces bug. Use underscores, or the REST announce endpoint.

FAQ#

Do Palworld admin commands work in co-op?

No. The command set exists on the dedicated server only. A world hosted from inside the game has no admin password, no RCON and no REST API, which is one of the better reasons to move a group's world onto a dedicated server.

Can I give someone admin rights without sharing the password?

Not in the base game. There is one shared AdminPassword and no per-player admin list, so the practical approach is to keep the password to one or two people and give everybody else what they actually need: a panel subuser account with console access and nothing else.

What is the difference between Shutdown and DoExit?

Shutdown takes a countdown in seconds and a message, announces it, saves and exits cleanly. DoExit ends the process immediately with no warning and no guaranteed save. Use DoExit only when the server has stopped responding to anything else.

Is RCON or the REST API the better choice?

The REST API, when your build has it. It returns structured JSON, it has a working announce endpoint, and /v1/api/settings and /v1/api/metrics have no RCON equivalent. RCON is worth enabling as well because more existing tools speak it.

How do I find a player's SteamID64?

Run ShowPlayers while they are connected and take the third column. Do not ask them for it: the number shown on a Steam profile page is the same value, but people paste the vanity URL or the 32-bit form instead, and neither works.

Does enabling RCON slow the server down?

No. It is an idle TCP listener that does nothing until a client connects. The cost of enabling it is the security exposure, not the performance, which is why the answer is to enable it and firewall it rather than to leave it off.