How to Configure Your FiveM Server.cfg File?

Getting the FiveM server.cfg right is the difference between a roleplay server that boots in ten seconds and one that spams console errors for hours. This file is the single entry point for your endpoints, license key, OneSync mode, resources, ACE permissions and RCON. Here is a complete, up-to-date 2026 walkthrough, from a blank config to a tuned production server.

What the FiveM server.cfg actually does

When FXServer starts, it reads one file passed with the +exec argument — by convention server.cfg, located in your server data folder (next to resources/). Every line is a console command executed in order, exactly as if you typed it in the live console. That single fact explains most of the classic mistakes: order matters, a resource cannot be started before its dependencies, and a variable set after a resource loads may be ignored.

A typical file tree on a managed host or a self-managed machine looks like this:

/home/container/
├── alpine/                # FXServer runtime (artifacts)
├── resources/
│   ├── [system]/
│   ├── [gameplay]/
│   ├── [local]/
│   └── ...
├── cache/
└── server.cfg

On a Serveur FiveM hosted with a Pterodactyl panel, you edit server.cfg directly from the file manager or the built-in editor, then restart the container. No FTP round-trip needed, and the live console shows you the parse result immediately.

Syntax rules you must respect

• One command per line. No semicolons, no braces.
• Comments start with # — and only at the beginning of a line, to stay safe.
• Quotes are required for any value containing spaces: sv_hostname "My RP Server".
• Case sensitivity applies to resource names: ensure esx_policejob ≠ ensure ESX_policejob.
• Order of execution: endpoints and convars first, resources next, permissions last (or before the resources that read them, if a script checks ACEs on load).

ensure, start, stop, restart

Four commands, one recommendation:

Command	Behaviour	Use in server.cfg
start name	Starts the resource; errors if already running	Legacy, avoid
ensure name	Starts it, or restarts it if already running	Recommended
stop name	Stops a running resource	Useful to disable a default resource
restart name	Stop + start	Live console only

Always use ensure. It makes hot-reloading during development predictable and avoids "resource already started" noise in the console.

Building a complete FiveM server.cfg step by step

Below is a production-grade skeleton. Copy it, then adapt the values. Each block is explained after the snippet.

1. Endpoints and network

# Bind on all interfaces, default FiveM port
endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"

# Slots (be realistic: CPU-bound, not slot-bound)
sv_maxclients 48

# Enable OneSync (required above 32 players)
set onesync on
set onesync_population true
set onesync_distanceCullVehicles true

Ports: FiveM uses the same number for TCP and UDP. If your host assigns you a port other than 30120, replace both lines. On a managed panel the allocation is done for you and injected automatically — do not hardcode a port that does not belong to your allocation, the server will fail to bind.

OneSync: on (infinity) is the modern default and lifts the 32-player ceiling. onesync_population lets the server drive NPC/vehicle population; turn it off if your framework handles population itself. Distance culling reduces the amount of entity data sent to each client, which directly lowers bandwidth and client-side stutter on populated servers.

2. Identity and listing

sv_hostname "^2[FR] MyCity RP ^7| Whitelist | Custom Scripts"
sv_projectName "MyCity RP"
sv_projectDesc "Serious roleplay, custom MLOs, active staff"

# Tags shown in the server browser
sets tags "roleplay, esx, français, whitelist"
sets locale "fr-FR"
sets banner_detail "https://cdn.example.com/banner_detail.png"
sets banner_connecting "https://cdn.example.com/banner_connect.png"
sets Discord "https://discord.gg/xxxxxxx"

load_server_icon myicon.png

sets (with an s) exposes the variable to the server list and to clients. set keeps it server-side only. sv_hostname supports colour codes (^1 red, ^2 green, ^7 white). Keep it readable: an overloaded hostname full of symbols is filtered out by many players. The server icon must be a 96x96 PNG placed next to server.cfg.

3. License key and Steam API

sv_licenseKey "cfxk_XXXXXXXXXXXXXXXXXXXXXXXX_XXXXX"
set steam_webApiKey "none"

The license key is generated on the Cfx.re keymaster portal and is tied to an IP or to a "no IP" wildcard. If you migrate your server to another machine or another host, regenerate or edit the key, otherwise FXServer refuses to start with a License key is invalid message.

steam_webApiKey is only needed if your framework identifies players by Steam ID. Setting it to none disables Steam identifier resolution — perfectly fine if you use license/discord/fivem identifiers. Never commit this key to a public Git repository.

4. RCON and administration

# Long, random, never reused
rcon_password "b7Xq!2mZ9pL#4vRt8Ns"
sv_endpointprivacy true

RCON gives full console access over the network. Treat it as root access to your server. Use at least 20 random characters, rotate it after any staff departure, and if you do not use RCON at all, leave the line out entirely — an unset RCON password disables remote console. sv_endpointprivacy true hides player IPs from the public players endpoint, which is a basic anti-doxxing measure for your community.

5. ACE permissions and principals

# Groups
add_ace group.admin command allow
add_ace group.admin command.quit deny
add_ace group.moderator command.say allow

# Attach identifiers to groups
add_principal identifier.fivem:1234567 group.admin
add_principal identifier.license:abcdef0123456789abcdef0123456789abcdef01 group.admin
add_principal identifier.discord:198765432109876543 group.moderator

# Resource-level permissions
add_ace resource.myjob command.add_vehicle allow

ACE (Access Control Entries) is the native FiveM permission system. A principal is who (an identifier or a group), an ace is what (a command or an arbitrary permission string). Frameworks like ESX or QBCore layer their own admin tables on top, but ACEs remain the authoritative layer for native console commands and for IsPlayerAceAllowed() checks in scripts.

Practical rule: never grant command allow to a group you are not ready to hand full server control to. Explicitly deny destructive commands (quit, stop, load_server_icon abuse) for intermediate ranks.

6. Resource loading order

# --- Core / system ---
ensure mapmanager
ensure chat
ensure spawnmanager
ensure sessionmanager
ensure basic-gamemode
ensure hardcap
ensure baseevents

# --- Database & framework ---
ensure oxmysql
ensure es_extended

# --- Categories (folders in brackets) ---
ensure [voice]
ensure [gameplay]
ensure [jobs]
ensure [maps]

# --- Local / custom scripts last ---
ensure [local]

Any folder wrapped in square brackets is a category, and ensure [gameplay] starts every resource inside it. That keeps your config short and readable, but it removes fine-grained order control inside the category — so never mix a framework core and its dependants in the same bracket folder.

Golden rule of ordering: database connector → framework core → shared libraries → jobs and gameplay → maps → UI/HUD. A resource that calls an export from a resource started later will throw No such export at boot.

7. Convars for your scripts

set mysql_connection_string "mysql://fivem:[email protected]:3306/fivem?charset=utf8mb4"
set es_enableCustomData 1
setr voice_useNativeAudio true
setr UseDebug false

Three prefixes to remember: set (server only), setr (replicated to clients, readable client-side), sets (server list metadata). Store your database credentials with set, never with setr or sets, otherwise every connected client can read them.

Performance, hardware and common server.cfg mistakes

A clean FiveM server.cfg will not save a server running on a shared, low-frequency CPU. FXServer is heavily single-thread dependent: the main server tick processes scripts, sync and events sequentially. Two things dominate perceived performance:

• CPU single-core frequency — this is why high-frequency Ryzen platforms are the standard for FiveM. More cores help MySQL and the OS, but the game loop lives on one thread.
• Disk latency — NVMe SSD storage matters for MySQL queries, resource streaming (custom MLOs, vehicle streams) and boot time. A server with 4 GB of stream assets on mechanical storage takes minutes to load and stutters on first entity spawn.

Add an anti-DDoS layer on top: FiveM servers are frequently targeted during roleplay peak hours, and a volumetric attack on UDP 30120 will drop every player regardless of how well your config is written. On Fly-Serv, anti-DDoS protection is included by default on all game servers and VPS, so you do not have to build a mitigation stack yourself.

Config settings that impact server tick

# Cap entities to avoid runaway spawns
set sv_enforceGameBuild 3407
set sv_scriptHookAllowed 0
set sv_pureLevel 1

# Reduce sync load on big servers
set onesync_distanceCullVehicles true
set onesync_forceMigration true

• sv_scriptHookAllowed 0 blocks client-side script hooks — mandatory on any serious roleplay server, this is your first anti-cheat line.
• sv_pureLevel 1 rejects clients with modified game files; level 2 is stricter but breaks some legitimate graphic mods. Start at 1, escalate if you see file-based cheats.
• sv_enforceGameBuild pins the GTA V build so that DLC vehicles and MLOs behave consistently. Change it only when you actually need assets from a newer build, and test your maps afterwards.

The five errors we see most often

1. Duplicate ensure lines for the same resource — causes a double start and event handlers registered twice (duplicated notifications, doubled money transactions).
2. License key mismatch after a migration — the server exits immediately; regenerate the key against the new IP.
3. Endpoints commented out or bound to 127.0.0.1 — the server runs but nobody outside the machine can connect.
4. Permissions declared after the resources that read them — admin menus load with no rights. Move add_ace/add_principal above your framework ensure block if a script caches ACEs at start.
5. Spaces in resource folder names — FXServer will not load my job script. Use underscores or dashes only.

Reading errors from the console

The live console in a Pterodactyl panel is your debugger. Useful commands to type while the server runs:

resmon 1              # client-side resource monitor (F8 in game)
status                # connected players and identifiers
refresh               # rescan the resources folder
ensure myresource     # hot reload a single script
svgui / profiler      # server-side profiling (record then view)

For server-side profiling: profiler record 500, then profiler save myprofile.json, and inspect the timeline. It tells you exactly which resource eats your tick budget — usually a badly written loop with Wait(0) or an uncached SQL query in an event handler.

Self-hosting on a VPS versus a managed FiveM panel

You can run FXServer yourself on a Linux machine. It is legitimate and gives you total control over the OS, the database and the reverse proxy. Here is a minimal, realistic setup on Debian/Ubuntu.

Manual installation on a VPS Linux

# 1. Dependencies
sudo apt update && sudo apt install -y curl xz-utils git mariadb-server screen

# 2. Dedicated user (never run FXServer as root)
sudo adduser --disabled-password --gecos "" fivem
sudo su - fivem

# 3. Artifacts
mkdir -p ~/server && cd ~/server
curl -sSL -o fx.tar.xz https://runtime.fivem.net/artifacts/fivem/build_proot_linux/master/LATEST/fx.tar.xz
tar xf fx.tar.xz && rm fx.tar.xz

# 4. Server data
cd ~ && git clone https://github.com/citizenfx/cfx-server-data.git server-data

# 5. First run
cd ~/server-data
bash ~/server/run.sh +exec server.cfg

Then make it a service so it survives a reboot:

sudo tee /etc/systemd/system/fivem.service > /dev/null <<'EOF'
[Unit]
Description=FiveM FXServer
After=network.target mariadb.service

[Service]
User=fivem
WorkingDirectory=/home/fivem/server-data
ExecStart=/bin/bash /home/fivem/server/run.sh +exec server.cfg
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now fivem
sudo systemctl status fivem
journalctl -u fivem -f

Hardening the VPS

# SSH keys instead of passwords
ssh-keygen -t ed25519 -C "admin@mycity"
ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@YOUR_IP
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart ssh

# Firewall: SSH + FiveM only
sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw allow 30120/tcp
sudo ufw allow 30120/udp
sudo ufw enable

# Brute-force protection
sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

Keep MySQL bound to 127.0.0.1, schedule mysqldump backups with cron, and never expose port 3306 publicly. A VPS Linux gives you that freedom; if you prefer the panel workflow without giving up root, a VPS Pterodactyl lets you host several game instances behind one management interface.

When a managed game server makes more sense

Criterion	Self-hosted VPS	Managed FiveM server
OS control	Full root	Container scope
Setup time	30–90 min	Instant install
Updates (artifacts, OS)	Manual	Handled via panel
Automatic backups	To configure yourself	Included
Anti-DDoS	Depends on provider	Included by default
Editing server.cfg	SSH / SFTP	Web file manager + live console

Both approaches read the exact same server.cfg. The file you write today is portable: you can start on a managed instance, export your resources and config, and move to a VPS later without rewriting a single line. The official documentation on docs.fivem.net is the reference for every convar mentioned here, and it is updated with each artifact release.

Backup routine you should not skip

• server.cfg + resources/: versioned in a private Git repository, with secrets stripped out.
• MySQL database: nightly dump, retained at least 7 days, stored off the game server.
• Test restore once a month. A backup you have never restored is a hypothesis, not a backup.

If you also run other communities, the same discipline applies to a Serveur Minecraft or a Serveur Rust — config file, world data, plugins, and a tested restore path. More configuration guides are collected on the Blog Fly-Serv.

Conclusion

A solid FiveM server.cfg is short, ordered and documented: endpoints first, identity and license next, permissions, then resources from core to custom. Combine it with a high-frequency CPU, NVMe storage, ScriptHook disabled and regular backups, and you get a server that boots clean and stays stable under load. Version the file, and every future change becomes reversible.

FAQ

Why does my FiveM server start but nobody can join?

Check three things in order. First, your endpoint_add_tcp and endpoint_add_udp must bind to 0.0.0.0 on the port your host allocated, not 127.0.0.1. Second, open that port in both TCP and UDP on your firewall (ufw allow 30120/tcp and /udp). Third, verify the license key is valid for the current IP; an invalid key makes the server run locally but stay invisible in the browser.

In what order should resources be listed in server.cfg?

Database connector (oxmysql) first, then the framework core (es_extended or qb-core), then shared libraries, then jobs and gameplay scripts, then maps and MLOs, and finally your custom or local resources. Always use ensure instead of start. If a script logs a "No such export" error at boot, it is almost always loading before the resource it depends on.

Should I set sv_maxclients to the maximum my host allows?

No. Set it to the number of players your CPU and scripts can actually sustain. FXServer is single-thread bound, so a heavy roleplay framework with many jobs and MLOs may hit its tick budget well before the slot limit. Use profiler record 500 during a peak session, identify the resources eating the most time, optimise them, then raise sv_maxclients gradually while watching server tick and player-reported desync.