FREE TOOL · SERVER CONFIG

FiveM server.cfg generator

A server.cfg is four separate jobs in one file — bind the ports, publish the listing, set the rules, start the resources in an order that works — and three of them fail silently. This builds the whole thing, checks it against the values the FiveM docs actually publish, and says what would stop it booting while you are still typing.

23 convars from the server command reference, 5 marked deprecated there, 4 that work and are not in it. Every row below says which. Nothing you type leaves your browser.

1 thing would stop this booting

42 active lines · ESX Legacy · OneSync on · 48 slots · 4 of your own resources

licenseKey No sv_licenseKey. The server prints "Could not get a license key" and exits — this is not a warning you can boot past. Generate one at portal.cfx.re and paste it in.

Framework

This picks the start order, not just a label. Each one comes from the framework's own repository rather than from a forum post.

ESX’s own cfg does not start mapmanager, sessionmanager or basic-gamemode. Adding basic-gamemode back is the single most common reason people spawn in the sea at 0,0,0.

Order from esx_core — server.cfg in the repository root.

Write the core and framework start block

Host name and listing

sv_hostname

FAM Roleplay | serious rp, custom cars

38 visible characters. The caret codes do not take up room in the list, only the text does.

undocumented The caret codes are what the client draws in the server list. The published formatting reference covers the tilde codes (~r~, ~h~) for in-game UI text and says nothing about carets or host names — so this mapping is observed behaviour, not a spec.

sets sv_projectName — the community name, not a tag list

sets sv_projectDesc — one sentence

sets locale

sets tags — comma separated

sets banner_detail — the wide image on the info page

sets banner_connecting — shown while a player joins

undocumented locale, tags, banner_detail and banner_connecting are not in the server command reference. What sets does is documented — it publishes a convar to the connect page, the server list and info.json — and these four names are the ones the browser reads. Treat them as convention with a documented mechanism.

Endpoints, slots and OneSync

Bind IP

Port — TCP and UDP both

0.0.0.0 binds every interface, which is what you want unless the machine has several NICs. The same port goes on both lines: TCP carries HTTP, the listing heartbeat and resource downloads, UDP carries the session. A firewall with only the TCP rule gives you a server that lists perfectly and that nobody can join.

sv_maxclients — 48

Documented as an integer from 1 to 2048. 32 and above requires OneSync on or legacy; above 64 requires on. OneSync itself is free up to 48 slots — past that the key needs a paid Cfx Portal tier.

onesync_population — NPCs and traffic spawn (documented default: true)

sv_entityLockdown

Strict is the single biggest anti-cheat win in this file, and the thing most likely to break a resource that spawns a vehicle from the client. Turn it on, then fix what complains.

Keys and client rules

sv_licenseKey — from portal.cfx.re

Nothing is sent anywhere — this page has no server side and the file is built in your browser. If you would rather not paste a key into a web page at all, leave it blank and the generator writes a placeholder line for you to fill in over SSH.

steam_webApiKey — 32 hex characters

rcon_password — leave blank and RCON stays off

sv_enforceGameBuild — startup only

sv_pureLevel

sv_scriptHookAllowed — the docs call this not recommendedsv_endpointPrivacy — hide player IPs from public reportssv_master1 "" — list as private

Permissions

Write the ACE block

Four groups in a chain: add_principal [child] [parent] makes the child inherit the parent, so an ACE granted to mod reaches admin and god too. That is the part people miss, and it is why so many cfg files carry the same twelve lines four times.

group.godYou. Everything, including the commands that take the server down or rewrite the permission list.command allow
group.adminEvery command except quit and the ACL commands — so an admin cannot grant themselves god, and cannot stop the server by accident.command allow · command.quit deny · command.add_ace deny · command.add_principal deny · command.remove_ace deny
group.modRestart a stuck resource, nothing that changes configuration. No exec, so a mod cannot load another cfg over yours.command.ensure allow · command.restart allow · command.start allow · command.stop allow · command.quit deny · command.exec deny
group.userThe floor. It holds no console commands at all — it exists so your own scripts have one principal to check against for "is this somebody we know".no console commands

Your identifier — goes into group.god

Run players in the server console while you are connected and it prints yours. The cfg writes identifier. in front of it; license:, steam:, discord:, fivem: and ip: are all valid. Use license: — it survives a Discord account change and a new IP.

Your resources

One per line, in load order. Anything whose exports another resource reads goes above the thing that reads it — the cfg is the only ordering you get for resources that do not declare dependency in their own manifest.

ensure …

4 resources. A folder in brackets — [myserver] — starts as a category, but its contents start in no guaranteed order, so a bracketed folder is not a substitute for getting the order right.

server.cfg142 lines

The whole file

Save it as server.cfg in the server-data folder, next to the resources directory, and start the server with +exec server.cfg.

# ============================================================
#  server.cfg — FAM Roleplay
#  Built with fam-tools.com/free-tools/server-cfg-generator
#  Framework: ESX Legacy · OneSync: on · 48 slots
# ============================================================

# ----------------------------------------------------------- endpoints --
# Both lines take the same port. TCP carries HTTP, the server list
# heartbeat and resource downloads; UDP carries the game session.
# Open both in the firewall or the server lists fine and nobody joins.
# Only change the IP on a machine with several network interfaces.
endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"

# ------------------------------------------------------------ identity --
# sv_hostname is deprecated — portal.cfx.re is now the authority and
# overrides it. Kept here because most panels still read the cfg.
# ^0-^9 are colour codes the server list draws. Tilde codes (~r~) are
# for in-game UI text and are printed literally here.
sv_hostname "^2FAM^7 Roleplay ^8| ^7serious rp, custom cars"

# sets publishes a convar to the connect page, the server list and
# info.json — which is exactly what the browser reads these from.
sets sv_projectName "FAM Roleplay"   # deprecated; Portal wins
sets sv_projectDesc "A serious roleplay server with a working economy and custom vehicles."   # deprecated; Portal wins
sets locale "en-GB"
sets tags "roleplay, serious rp, economy, custom cars"

# A 96x96 PNG beside server.cfg. Deprecated in favour of the Portal.
# load_server_icon myLogo.png

# ------------------------------------------- slots and state awareness --
# sv_maxClients is 1-2048. 32 and above needs onesync on or legacy,
# above 64 needs onesync on. OneSync itself is free to 48 slots.
sv_maxclients 48

# Full state awareness. The server decides which entities each client is told about, which is what lets a script read an entity nobody is standing next to.
set onesync on
set onesync_population true   # NPCs and traffic spawn
# Infinity defaults to true and is startup-only. Leave it alone
# unless you know why you are turning it off.
# set onesync_enableInfinity true

# ---------------------------------------------------------------- keys --
# Without a licence key the server prints "Could not get a license
# key" and exits. Get one at portal.cfx.re.
sv_licenseKey "PUT_YOUR_KEY_HERE"

# Required for the server to return steam: identifiers at all.
set steam_webApiKey ""

# RCON stays disabled while this is unset. That is the right default.
# set rcon_password ""

# -------------------------------------------------------- client rules --
sv_scriptHookAllowed 0   # blocks Script Hook plugins
sv_endpointPrivacy true   # hides player IPs from public reports

# Startup only — it cannot be changed while the server runs.
# 3407 = mp2024_02 (Agents of Sabotage.)
sv_enforceGameBuild 3407

# 1-5, least to most likely to change / least to most trustworthy.
# set sv_authMaxVariance 5
# set sv_authMinTrust 1

# --------------------------------------------------------- permissions --
# add_principal [child] [parent] — the child inherits the parent.
# add_ace [principal] [object] [allow|deny]
#
# The chain runs god > admin > mod > user, so an ACE granted to mod
# reaches admin and god as well and does not need repeating. Define
# the ACL before the resources start: a resource that checks a
# permission on its first tick checks it against whatever exists now.
add_principal group.god group.admin
add_principal group.admin group.mod
add_principal group.mod group.user

# god — You. Everything, including the commands that take the server down or rewrite the permission list.
add_ace group.god command allow

# admin — Every command except quit and the ACL commands — so an admin cannot grant themselves god, and cannot stop the server by accident.
add_ace group.admin command allow
add_ace group.admin command.quit deny
add_ace group.admin command.add_ace deny
add_ace group.admin command.add_principal deny
add_ace group.admin command.remove_ace deny

# mod — Restart a stuck resource, nothing that changes configuration. No exec, so a mod cannot load another cfg over yours.
add_ace group.mod command.ensure allow
add_ace group.mod command.restart allow
add_ace group.mod command.start allow
add_ace group.mod command.stop allow
add_ace group.mod command.quit deny
add_ace group.mod command.exec deny

# user — The floor. It holds no console commands at all — it exists so your own scripts have one principal to check against for "is this somebody we know".
# (no console commands; group.user exists for your own scripts to check)

# You. Run `players` in the console while connected to read your own
# identifier, then paste it after identifier. — license:, steam:,
# discord:, fivem: and ip: are all valid prefixes.
add_principal identifier.license:0000000000000000000000000000000000000000 group.god

# Your framework and your own resources define their own ACE objects
# on top of the command.* ones above. Grant them here, for example:
# add_ace group.admin my_garage.impound allow

# ----------------------------------------------------------- resources --
# -- the server's own, for ESX Legacy --
# ensure restarts a running resource and starts a stopped one, so a
# cfg full of ensure is safe to re-exec. start only ever starts.
ensure chat                       # ESX uses the chatMessage event.
ensure spawnmanager               # es_extended calls the spawnmanager exports.
ensure hardcap                    # Enforces the slot limit.

# -- ESX Legacy, in this order --
# ESX’s own cfg does not start mapmanager, sessionmanager or basic-gamemode. Adding basic-gamemode back is the single most common reason people spawn in the sea at 0,0,0.
ensure oxmysql                    # The database layer. Nothing in ESX can query before this is up.
ensure esx_lib                    # The shared library esx_core’s own cfg starts before the core.
ensure es_extended                # The core itself. Everything esx_* waits on this.
ensure [core]                     # The bracketed folder of esx_* resources, started as a category.

# Not started on purpose: basic-gamemode spawns the player itself
# and fights ESX Legacy for the spawn. mapmanager and sessionmanager
# are only needed by the freeroam gamemode.

# -- yours --
# Anything that other resources read exports from goes above the
# things that read it. The cfg is the only ordering you get for
# resources that do not declare `dependency` in their manifest.
ensure my_hud
ensure my_garage
ensure my_jobs
ensure my_notify

# Nested configs, if the list gets long:
# exec resources.cfg

# convars your scripts can read with GetConvar:
# set my_script_debug "false"

steamKey With no steam_webApiKey the server never returns a steam: identifier. If any of your scripts or your whitelist keys off Steam, they will see nothing. Get one from steamcommunity.com/dev/apikey.
hostname sv_hostname, sets sv_projectName, sets sv_projectDesc and load_server_icon are all marked deprecated in the server command reference, which points at portal.cfx.re instead. They still work and the generator still writes them, because the Portal does not cover every field and plenty of hosts read the cfg — but the Portal is now the authority, and if the two disagree the Portal wins.

HOW TO USE IT

From this page to a running server

Six steps. The order is the order, because two of them cannot be undone once the server has booted.

Pick the framework first. It rewrites the whole start block, so doing it last means re-checking everything. Standalone gives you the seven resources that ship in cfx-server-data; the other three give you that framework's own documented order with the default gamemode removed, because it fights the framework for the spawn.
Set the slot count and the OneSync mode together. They constrain each other: from 32 slots up you need OneSync on or legacy, above 64 you need on. The tool refuses the combinations the server refuses rather than letting you find out from the console.
Write the host name with the colour picker. The preview is what the server list draws. Keep the visible text short — the list truncates, and a name that reads as a keyword dump is the first thing a player scrolls past.
Paste your licence key, or don't. It is built in your browser either way. Leaving it blank writes a placeholder line and the server will tell you about it once; a wrong key is harder to spot than a missing one.
List your own resources in load order. Database layer, then libraries, then the core, then everything that calls into it. If you are not sure, the rule is: whatever exposes exports goes above whatever reads them.
Download it as server.cfg into server-data, beside the resources folder, and start the server with +exec server.cfg. Then read the console from the top: the first error is the real one and everything after it is usually a consequence.

Two settings you cannot change later without a restart

sv_enforceGameBuild and onesync_enableInfinity are both documented as startup-only. Changing them in a live console does nothing, which is a very convincing way to waste an evening. Edit the cfg, then restart the server process — not the resource.

REFERENCE

Every convar this file can contain

With where each one comes from, because a convar somebody made up and a convar in the reference look identical once they are in a file.

Convar	Values	What it does	Source
endpoint_add_tcp	"ip:port"	Binds a TCP endpoint. Carries HTTP, the listing heartbeat and resource downloads.	documented
endpoint_add_udp	"ip:port"	Binds the UDP host instance that carries the game session. The address and port must be free.	documented
sv_maxClients	1 – 2048	The slot limit. 32 and above needs onesync on or legacy; above 64 needs onesync on.	documented
sv_hostname	string	The host name in the server list. The docs point at portal.cfx.re instead, and the Portal overrides it.	deprecated
sv_licenseKey	string from portal.cfx.re	The Cfx key. Without it the server exits on boot.	documented
steam_webApiKey	32 hex characters	Required before the server returns any steam: identifier.	documented
onesync	on \| legacy \| off	State awareness. on = full, server-determined entity routing. legacy = compatibility. off = relay only.	documented
onesync_population	true \| false (default true)	NPC and traffic spawning. Off means an empty map.	documented
onesync_enableInfinity	true \| false (default true)	The Infinity system, needed for large player counts. Startup only.	documented
onesync_enableBeyond	true \| false	Listed under deprecated and compatibility variables — "not necessary anymore". It has no effect. Delete it from any cfg you inherit.	deprecated
sv_entityLockdown	inactive \| relaxed \| strict	Who may create networked entities. strict stops a client spawning anything the server did not ask for.	documented
sv_scriptHookAllowed	0 \| 1 (default false)	Allows Script Hook plugins. The docs call it not recommended, and say it does not guarantee players cannot use external plugins anyway.	documented
sv_endpointPrivacy	true \| false	Hides player IP addresses from public reports the server outputs.	documented
sv_pureLevel	1 \| 2	Blocks modified client files. 1 allows audio and known graphics mods, 2 allows nothing.	documented
sv_enforceGameBuild	a build number or alias	Pins the DLC build clients load. Startup only — it cannot change at runtime.	documented
sv_master1	""	Set to "" to list as private. It cannot de-list a server from the master list.	documented
rcon_password	string	Enables RCON over UDP. Unset means RCON is disabled, which is the safe default.	documented
sv_authMaxVariance	1 – 5 (default 5)	How likely an accepted identifier is to change, least to most.	documented
sv_authMinTrust	1 – 5 (default 1)	How trustworthy an identifier has to be, 5 being external three-way authentication.	documented
sv_listingHostOverride	host	Overrides the hostname sent to the master server. For a server behind a proxy that rewrites it.	documented
sv_forceIndirectListing	true \| false (default false)	Stops the server being advertised by its real IP; the proxy or override settings are used instead.	documented
sets sv_projectName	string	The community name. Documented as a name, not a list, and not tags — a non-compliant name is cut off in the list.	deprecated
sets sv_projectDesc	string	One sentence describing the project. The Portal is now the authority.	deprecated
sets locale	en-GB, de-DE, root-AQ …	The flag and language filter in the browser. The sets mechanism is documented; this convar name is not in the command reference.	undocumented
sets tags	comma-separated	The comma-separated tag list the browser filters on. Not in the command reference, and no published length limit.	undocumented
sets banner_detail	an https URL	The wide image on the server’s info page. Not in the command reference.	undocumented
sets banner_connecting	an https URL	The image shown while a player connects. Not in the command reference.	undocumented
load_server_icon	fileName.png	Loads a 96x96 PNG as the server icon. The docs point at the Portal.	deprecated
add_ace	[principal] [object] allow\|deny	Adds an entry to the access control list.	documented
add_principal	[child] [parent]	Makes a principal inherit another. The child is the first argument.	documented
ensure	resource or category	Starts a stopped resource and restarts a running one — so a cfg of ensure lines is safe to re-exec.	documented
exec	filename	Runs another cfg, relative to the server data directory, or from a resource with @.	documented

Checked against server commands, convars and the example server.cfg. The four undocumented rows are server-info convars: the sets mechanism that publishes them to the server list is documented, the names themselves are convention.

QUESTIONS

About the server config

Will the file this gives me actually boot?

Yes, provided you put a real licence key in it. Every convar it writes is from the FiveM server command reference, with the value range the docs publish, and the validator refuses the combinations the server itself refuses — 48 slots with OneSync off, for instance, or a resource started twice. The one thing it cannot do for you is generate a Cfx key: that comes from portal.cfx.re and the server exits on boot without it.

Why does it say sv_hostname is deprecated?

Because the server command reference says so, in those words, and points at portal.cfx.re instead. So do sets sv_projectName, sets sv_projectDesc and load_server_icon. They all still work, and the generator still writes them, because plenty of panels and hosts read the cfg and because the Portal does not cover every field — but if the cfg and the Portal disagree about your name, the Portal wins. A generator that hands you sv_hostname without mentioning that is teaching you something that is on its way out.

What sv_maxclients can I actually use?

The documented range is 1 to 2048. Within that: values from 32 up need onesync set to on or legacy, and values above 64 need onesync on, because legacy tops out at 64. Separately from the technical limit, OneSync is free up to 48 slots and anything above that needs a paid Cfx Portal tier on the key. So 48 with onesync on is the usual honest answer, and a cfg claiming 128 slots on a free key is a cfg that will quietly drop back.

Does it matter what order the resources start in?

It matters more than almost anything else in the file. The cfg is the only ordering you get for a resource that does not declare dependency in its own fxmanifest.lua, so a database layer below the core that queries it, or a framework below the job scripts that call its exports, gives you nil export errors that look random because they depend on how fast each resource happens to load. A bracketed folder — [myserver] — starts as one category but its contents start in no guaranteed order, so it is not a fix for this.

Why does starting a resource twice break things?

ensure restarts a resource that is already running. So a second ensure halfway down your cfg tears the resource down and brings it back up, and anything that already grabbed its exports during the first start is holding a reference to the dead copy. The symptom is an "attempt to index a nil value" on roughly every third restart, which is why it takes people weeks to find. The validator here flags it as an error, including when one of your own lines collides with the framework block.

Do the ^1 ^2 colour codes work everywhere?

They work in the host name and in chat, and they are not in the documentation anywhere — the published text-formatting reference covers the tilde codes, ~r~ and ~h~ and the rest, which are for in-game UI labels and are drawn as literal text in a host name. This page marks the caret table as undocumented for exactly that reason. Only ^0 to ^9 are reliable; a bare ^ or a ^* is printed as-is.

MORE

The other generators

fxmanifest.lua generator

The resource manifest, with the load order explained — why shared_scripts goes first, why a missing files entry gives you a blank NUI page, and which keys the docs now call deprecated.

All the free tools

The interactive map, the bitmask calculators and every reference table.

ALSO FREE

Tools that go with this one

Picked because they touch the same files, natives or part of the game.

Cfx blacklist check

Check whether a server key or an IP is on the Cfx.re blacklist before you spend a night debugging a boot failure.

Profiler analyzer

Drop a profiler capture and find out which resource is eating the frame, which loop inside it, and what to change.

Roleplay generators

Names for a character, a server, a gang or a business when the blank page is the thing stopping you.

FROM THE SHOP

What we build when it is not free

The free tools and the paid work come out of the same place. These are the lines closest to what this page is about.

Loading screens

Loading screens for FiveM

The one screen every player sees on every connect. Drag widgets onto a canvas, drop in a video background, and point your server at a single URL we host.

Free50 live widgets · 30 fontsOpen the screen builder

The Downtown Dusk graphics design, shown at Discord banner size

Graphics packs

Graphics packs for FiveM

One design, cut to every slot your server shows up in: the server list strip, the Discord header, the stream art, each composed for its own crop.

From $12.00124 designs · 20 formatsBrowse the designs