FiveM Console Commands: Server & Client Reference
A verified FiveM console commands reference: server commands, convars and F8 client commands, which ones affect security, and the ones that quietly bite you.
Roby Einstein
FairShieldAC Security Team
FiveM console commands live on two separate surfaces: the server console (the FXServer window, txAdmin's Live Console, RCon, or lines in server.cfg) and the client console you open in-game with F8. Different command sets, different permission models. Every entry below is taken from official documentation, with a default listed only where the docs publish one.
Server console vs F8 client console: two different surfaces
The server console runs commands with full server authority. Per the docs, they "can be executed either using an RCon tool, directly from the server console interface, a server configuration file, the server command line, or (if a resource is permitted by the ACL) the EXECUTE_COMMAND function." txAdmin's Live Console is the common route, which runs when FXServer starts in monitor mode.
The client console belongs to one player's copy of the game: "These commands can be used with the client console, which you can open by pressing F8." Several competing lists tell you to press F8 and then hand you a table of server commands, a common inaccuracy.
The overlap runs one way. Per the official RegisterCommand documentation, the client console runs "client side and server side registered commands", while the server console and RCon "only works for server side registered commands". F8 can therefore reach server commands, which get permission-checked server-side. For the argument about which side deserves your trust, see server-side vs client-side anti-cheat.
One detail explains a lot. The Cfx source seeds the global access control list with system.console mapped to the object command with ALLOW, so the server console holds a blanket allow on every command.
FiveM server commands: the daily reference table
These are the commands you reach for while a server is running. Two are not built into FXServer, which the last column flags. Source: docs.fivem.net/docs/server-manual/server-commands/.
| Command | What the docs say it does | Provided by |
|---|---|---|
| start [resourceName] | Starts the resource specified in the argument, if it was stopped. Also accepts a category, e.g. start [cars] | FXServer |
| stop [resourceName] | Stops the resource specified in the argument, if it was started. Categories supported | FXServer |
| restart [resourceName] | Restarts the resource specified in the argument, if it was started. A no-op on a stopped resource | FXServer |
| ensure [resourceName] | Restarts the resource if it was started; if it was not, starts it | FXServer |
| refresh | Rescans the resources folder and loads all resource manifests, making new resources available to start. Starts nothing by itself | FXServer |
| exec [filename] | Runs the commands in the filename, relative to the server data directory, or any resource name specified with @ (e.g. exec @vMenu/config/permissions.cfg) | FXServer |
| quit | Exits the server, sending a default quit message to all connected players | FXServer |
| quit [reason] | Exits the server, also sending the specified reason to all connected players | FXServer |
| status | Shows a list of players with their primary identifier, server ID, name, endpoint, and ping | the rconlog resource |
| clientkick [id] [reason] | Kicks the client with the specified server ID (as seen in status) from the server, for the stated reason | the rconlog resource |
| say [message] | Sends a message in the chat as console | the chat resource |
| svgui | Opens or closes the server debug GUI | FXServer |
| load_server_icon [file.png] | Loads a specified icon and sets it as the server icon. The icon needs to be a 96x96 PNG file | FXServer |
| con_channelFilters | Lists any active channel filters set to the end user | FXServer |
| con_addChannelFilter [filter] [action] | Adds a console channel filter; regex supported. Actions are noprint, drop and devonly | FXServer |
| con_removeChannelFilter [filter] [action] | Removes a previously applied channel filter | FXServer |
Server convars, with documented defaults
A convar is a console variable. You can type one into a live console, but the normal home is server.cfg, executed by exec at startup. The last column matters most: several are startup-only and do nothing in a running console. Where no default is published, the table says "not documented".
| Convar | What it controls | Documented default | Docs flag as startup-only? |
|---|---|---|---|
| gamename [game] | Defines the game to run the server for. Supported values are gta5 and rdr3 | not documented | Not stated |
| sv_hostname | The server-specific host name shown in the browser | not documented | Not stated |
| sets sv_projectName | Name of your project. Should be a name, not a list, and should not contain tags | not documented | Not stated |
| sets sv_projectDesc | Description of your project, written as a sentence | not documented | Not stated |
| gametype / mapname | Game type and map name displayed in the server browser | not documented | Not stated |
| sv_maxClients | Maximum clients, an integer from 1 to 2048. Values starting at 32 require onesync on or legacy; above 64 requires onesync on | not documented | Not stated |
| sv_licenseKey [key] | Sets the license key for this server | not documented | Not stated |
| sv_lan [true/false] | Makes the server LAN-only. It will not appear in the public server list and license key checks are skipped | false | Not stated |
| sv_master1 | Makes the server private, disabling the browser connect button. Cannot be used to de-list a server from the master list | not documented | Not stated |
| sets sv_appearAllowlisted | Makes the server appear allowlisted in the server browser, showing a lock icon | not documented | Not stated |
| sets sv_allowlistInstructions | Instructions shown in the browser. Requires sv_appearAllowlisted true | not documented | Not stated |
| sv_endpointPrivacy | If true, hides player IP addresses from public reports output by the server | not documented | Not stated |
| sv_kvsName | Name of the KVP database file, stored in the serverdata:/ folder | default | Startup-only |
| steam_webApiKey | Required to allow Steam identifiers to be returned by the server | not documented | Not stated |
| steam_webApiDomain | Domain registered with the Steam Web API key | api.steampowered.com | Not stated |
| sv_tebexSecret | Unique secret key used to authenticate your server with the Tebex platform | not documented | Not stated |
| sv_enforceGameBuild [build] | Selects a game build for clients to use. The docs state this can only be specified at startup and cannot be changed at runtime | not documented | Startup-only |
| sv_replaceExeToSwitchBuilds | Whether the client downloads and runs the old build exe, or runs latest-stable plus DLCs | true below build 12872; false above server build 12871 | Not stated |
| increase_pool_size [poolName] [increase] | Increases the size of the given pool. Clients must restart the game | not documented | Startup-only |
| onesync [on/off/legacy] | Defines which mode of state awareness to use. Legacy is documented as not recommended due to performance issues and graphical glitches | not documented | Not stated |
| onesync_enableInfinity | Enables the Infinity system for large-scale entity synchronization. Required for large player counts | true | Startup-only |
| onesync_population | Enables population spawning and management. Required for NPCs to spawn | true | Not stated |
| onesync_forceMigration | Forces entity migration when the current owner becomes irrelevant or disconnects | true | Not stated |
| onesync_distanceCulling | Removes entities from sync beyond a certain distance and outside the view matrix | true | Not stated |
| onesync_distanceCullVehicles | Applies the same distance culling to vehicles | false | Not stated |
| onesync_radiusFrequency | Adjusts entity state update frequency based on distance | true | Not stated |
| sv_useAccurateSends | Sends entity state updates based on actual relevance and distance | true | Not stated |
| net_tcpConnLimit [limit] | Tunes the concurrent connection limit per IP | 16 | Not stated |
| sv_tcpConnectionTimeoutSeconds | Time in seconds a TCP connection can be idle before it is closed | 5 | Not stated |
| sv_proxyIPRanges | Space-separated list of IP ranges in CIDR notation considered to be proxy servers | 10.0.0.0/8 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 | Not stated |
| sv_endpoints | Space-separated list of IP addresses clients can use to connect via UDP. If empty, the auto-detected public IP is used | not documented | Not stated |
| sv_forceIndirectListing | Prevents the server from being advertised using its real IP address | false | Not stated |
| sv_listingIpOverride | Overrides the IP address sent to the master server | not documented | Not stated |
| sv_listingHostOverride | Overrides the hostname sent to the master server | not documented | Not stated |
| sv_registerMulticastDns | Registers the server via mDNS for LAN discovery | true | Not stated |
| sv_enableNetEventReassembly | Enables reassembly of large network events split into multiple packets | true | Not stated |
| sv_netEventReassemblyMaxPendingEvents | Maximum pending reassembled network events per client, 0 to 254 | 100 | Not stated |
| sv_netEventReassemblyUnlimitedPendingEvents | Allows unlimited pending reassembled events per client, overriding the max above | false | Not stated |
| sv_prometheusBasicAuthUser / Password | Basic auth for the /perf endpoint. Leave empty to disable. Also sent to txAdmin | not documented (empty disables it) | Not stated |
| sv_experimentalStateBagsHandler | Uses the new serialization API to improve packing and unpacking of state bag changes. Introduced in build 8510 | true | Not stated |
| sv_experimentalOnesyncPopulation | Fixes an entity-id limit oversight with onesync on and onesync_population false. Introduced in build 8823 | true | Not stated |
| sv_experimentalNetGameEventHandler | New serialization API for GTA game events, with checks that entities sent are relevant to the target client. Introduced in build 9149 | true | Not stated |
set, sets and setr: the distinction almost nobody explains
A frequent cause of "my convar doesn't work", and also a quiet data-exposure problem. Each prefix changes who can read the value.
| Keyword | Scope | What the docs say |
|---|---|---|
| set | Server only | Standard convars can only be used in server-side scripts. They cannot be obtained or set from a client script |
| setr | Replicated to clients | The convar will be available on the client side to get the value, but you will only be able to change the convar value from the server side |
| sets | Public server info | Their name and value will appear on the server connect details/info page, on the server list, and will be exposed in the info.json server info file |
| seta | Client-side, archived | Set an archived variable on the client. The variables are saved in the CitizenFX fivem.cfg or redm.cfg file in AppData |
Read that sets row again. Anything published with sets is served to the open internet on your info.json endpoint. Licence keys, Steam Web API keys and Tebex secrets belong behind set. Source: docs.fivem.net/docs/scripting-reference/convars/.
Client console commands (F8)
The F8 console splits into commands any player can run and developer commands that are gated: "Developer commands require the client to run in a developer mode, or they'll show an error like Access denied for command resmon or Command strdbg is disabled in production mode." Dev mode comes from +set moo 31337 or a non-production update channel.
| Client command | What it does | Documented default | Dev mode required |
|---|---|---|---|
| connect <server> | Connects to a server using a given IP address and port, or URL | not applicable | No |
| disconnect | Disconnects you from the server and returns to the main menu | not applicable | No |
| bind | Lists all configured bindings | not applicable | No |
| bind <mapper> <input> <command> | Binds an input to execute the specified command when pressed in-game | not applicable | No |
| rbind <resource> <mapper> <input> <command> | Same as bind, but only runs if the specified resource is in use on a server | not applicable | No |
| unbind <mapper> <input> | Unbinds all commands bound to the specified input | not applicable | No |
| cl_drawfps <bool> | Enables or disables the frames-per-second counter in the screen corner | not documented | No |
| cl_drawperf <bool> | Shows FPS, ping, packet loss, CPU usage, GPU usage and GPU temperature | not documented | No |
| quit / quit [reason] | Forces the client to close immediately, optionally sending a quit reason to the server | not applicable | No |
| loadlevel <level_name> | Starts a local game loading a level from the name supplied, e.g. gta5, rdr3, blank-map | not applicable | No |
| storymode | Starts FiveM story mode | not applicable | No |
| voice_enableNoiseSuppression <bool> | Reduces background noise in voice chat | true | No |
| voice_inBitrate <16000-128000> | Bitrate at which voice data is encoded | 48000 | No |
| cam_disableCameraShake <bool> | Disables camera shake effects, such as from explosions | false | No |
| cam_vehicleFirstPersonFOV <-1 to 130> | Sets the first person FOV of the vehicle | -1 | No |
| str_maxVehicleTextureRes <int> | Limits the maximum resolution of vehicle textures at the cost of visual quality | 1024 | No |
| nui_useInProcessGpu <bool> | Uses in-process GPU for CEF. May improve compatibility but reduces NUI performance. Requires a restart | false | No |
| cmdlist | Lists all commands registered on the client or server, plus variables set with set, sets and seta | not applicable | Yes |
| resmon <bool> | Opens the resource monitor, showing CPU and memory usage for each resource | not documented | Yes |
| netgraph <bool> | Real-time metrics about the client network usage: ping, in, out, routing packets and delay | not documented | Yes |
| netEventLog <bool> | Shows the direction of an event, the event name, and the size of the data sent | not documented | Yes |
| netobjviewer <bool> | Lists current objects and nodes being synchronized over the network when game state awareness is enabled | not documented | Yes |
| net_printOwner <objectID> | Prints the owner of a network object ID | not applicable | Yes |
| net_statsFile <file_name> | Writes ping, packet, byte and routing metrics to a CSV in the FiveM application data directory | not applicable | Yes |
| onesync_logFile <filename> | Saves client-side logs from the game state awareness subsystem. The docs note these files get large | not applicable | Yes |
| strdbg <bool> | Shows what is currently being loaded in the GTA streamer | not documented | Yes |
| strlist <bool> | Graphical interface showing entries registered in the GTA streamer and their current status | not documented | Yes |
| strmem <bool> | Listing of streaming memory used by specific streaming assets | not documented | Yes |
| se_debug <bool> | Enables verbose logging for security features like the ACL. Useful to see why people do or do not have access to certain commands | not documented | Yes |
| con_autoScroll <bool> | Automatically scrolls the dev console to the bottom when new log entries are added | true | Yes |
| con_miniconChannels <pattern> | Displays console messages on screen without opening the client console. Full match, with * wildcard | minicon:* | Yes |
| con_winconsole <bool> | Shows the windowed console dev tool | false | Yes |
| nui_devtools | Opens the NUI dev tools window from the game process | not applicable | Yes |
| modelviewer <bool> | Loads in TXDs and drawables via a graphical interface | not documented | Yes |
A few client convars can be pushed from the server with setr, which is how you enforce a setting rather than hope for it: game_sanitizeRagdollEvents (true, documented as preventing exploits that force the player into a ragdoll), game_enableDynamicDoorCreation (false) and game_originalBikeJump (false).
Which FiveM console commands are security-relevant
These change who can do what. Cfx ships these on permissive defaults for compatibility, not for safety - several default to the less restrictive setting. Read each default below as a starting point to review, not a safe baseline.
| Convar or command | Why it is security-relevant | Documented default |
|---|---|---|
| sv_scriptHookAllowed | Allows clients with Script Hook V to connect. The docs carry an explicit warning: not recommended, makes the server vulnerable to security issues | false |
| sv_entityLockdown [mode] | Controls how strict the server is about client-created entities. strict blocks all client-created entities; relaxed blocks only script-owned ones; inactive allows any; full disables dummy object creation and is Enhanced-only | inactive |
| sv_pureLevel [level] | Prevents users from using modified client files. Level 1 blocks all modified client files except audio and known graphics mods; level 2 blocks all modified client files. The docs state there are currently two levels | not documented |
| sv_filterRequestControl [mode] | Blocks REQUEST_CONTROL_EVENT routing based on a configurable policy, from -1 through 4 (0 is off; 4 never routes it) | 0 (Off) |
| sv_filterRequestControlSettleTimer | How long in milliseconds, by entity creation time, before an entity counts as settled. Applies to modes 1 and 3 | 30000 |
| sv_enableNetworkedSounds | Controls routing of NETWORK_PLAY_SOUND_EVENT, which the docs describe as commonly used by malicious actors | true (routing allowed) |
| sv_enableNetworkedScriptEntityStates | Controls routing of SCRIPT_ENTITY_STATE_CHANGE_EVENT, also described as commonly used by malicious actors. Introduced in build 8540 | true (routing allowed) |
| sv_enableNetworkedPhoneExplosions | Allows routing of REQUEST_PHONE_EXPLOSION_EVENT. The docs note the drawback is that it can also be used by malicious actors. Introduced in build 6831 | false |
| setr sv_stateBagStrictMode | When true, only the server can modify the state of networked entities and the player state. Introduced in build 12739 | false |
| block_net_game_event [eventName] | Adds the hash of a net game event to the list blocked by the server, used to prevent exploits | not applicable |
| unblock_net_game_event [eventName] | The opposite. Note it does not unblock events blocked by other means such as convars | not applicable |
| sv_authMinTrust | Trust is how unlikely it is for the user's identity to be spoofed by a malicious client. An integer from 1 to 5, least to most trustworthy | 1 |
| sv_authMaxVariance | Variance is how likely the user's identifier is to change for a given provider. An integer from 1 to 5, least to most likely to change | 5 |
| sv_requestParanoia | Helps counter proxy-based HTTP floods. 0 off; 1 blocks IPs sending Via; 2 blocks Upgrade-Insecure-Requests, which the docs warn includes browser-based .json requests; 3 also closes the socket | 0 |
| sv_httpFileServerProxyOnly | Restricts file-server access to sv_proxyIPRanges. Introduced in build 10543 | false |
| rcon_password [password] | Sets the RCon password. If unset, RCon is disabled. FXServer RCon uses UDP | unset, so RCon is disabled |
| sv_devMode (Enhanced only) | Enables development mode, automatically enables dev mode for joining clients, and limits max clients to 8. The docs say: do not enable in production | false |
| moo | A development-only bypass for pool validation. The docs say this is for development and debugging purposes only, and to never use it to bypass limitations in production | not applicable |
On RCon, the short version: it stays disabled until you set a password, and txAdmin's Live Console gives you per-admin permissions (console.view, console.write) and logging tied to a named human. The docs claim nothing about RCon transport beyond it being UDP.
ACE permissions: why you get "access denied"
Many command failures are permission failures. A server command registered with the restricted flag requires the calling principal to hold an ACE for the object command.<name>. Without it the console reports access denied.
| Command | What it does | Where it exists |
|---|---|---|
| add_ace [principal] [object] [allow|deny] | Adds an access control entry to the server's access control list | Server |
| remove_ace [principal] [object] [allow|deny] | Removes a specified ACE from the server's access control list | Server |
| add_principal [child] [parent] | Sets a principal to inherit from another principal | Server |
| remove_principal [child] [parent] | Removes a specified principal inheritance entry | Server |
| test_ace [principal] [object] | Tests if a principal is allowed or denied access to a given object | Server and client |
| list_aces | Lists every ACE as principal to object, ALLOW or DENY. Documented on the client page; registered on both surfaces in the Cfx source | Server and client |
| list_principals | Lists principal inheritance as child from parent. Same dual availability | Server and client |
| se_debug <bool> | Verbose ACL logging. Prints the full test, e.g. TEST ACL system.console to command.resmon, ACE system.console command, ALLOW | Client |
Three behaviours from the Cfx implementation are worth memorising. ACE objects are hierarchical: a check on command.foo.bar falls back to command.foo and then to command, which is why add_ace group.admin command allow hands over every command on the server. A deny entry short-circuits the check - the source comment reads "deny trumps all" - so any "first come, first served" reading is wrong. And builtin.everyone is injected into every check, so an ACE landing there covers everyone connected.
One command you will see referenced does not exist. add_acl appears once in the EXECUTE_COMMAND native docs, but the implementation registers only the seven above, and it refuses to touch your own access: "Changing ones own access is not permitted."
Commands that will bite you
Every item here is documented behaviour that surprises people.
- status and clientkick are not built into FXServer. Both are documented as "provided by the rconlog resource", so neither exists if rconlog is not started. say comes from the chat resource.
- restart only acts on a running resource. Against a stopped one it does nothing, with no obvious complaint. ensure covers both cases.
- refresh starts nothing. It rescans the resources folder and loads manifests so new resources become startable. You still need start or ensure.
- sets publishes to the internet. A sets convar's name and value appear on the connect details page, in the server list, and in the public info.json endpoint.
- add_ace group.admin command allow is a blanket grant covering everything including quit. The official example cfg follows it with add_ace group.admin command.quit deny, and deny short-circuits, so the order does not matter.
- add_ace silently rejects anything that is not literally allow or deny. The source prints "Access type needs to be 'allow' or 'deny'.", so a line ending in true achieves nothing.
- quit kills the whole server. clientkick removes a player, which is why command.quit is worth denying explicitly.
- sv_master1 does not de-list you. The docs say it "cannot be used to de-list a server from the master list." It disables the browser's connect button.
- Startup-only convars fail quietly at runtime. sv_enforceGameBuild, increase_pool_size, onesync_enableInfinity and sv_kvsName produce no error and no effect in a live console.
- sv_maxClients has OneSync preconditions. Values starting at 32 require onesync on or legacy, above 64 requires onesync on. The ceiling without OneSync is therefore 31.
- sv_endpointPrivacy hides IPs from public reports, not from your own tooling. Redact identifiers before pasting status output into a staff channel.
- Three convars are documented as doing nothing: onesync_enableBeyond, sv_enhancedHostSupport, and sv_protectServerEntities ("Not implemented. Use sv_entityLockdown instead").
- Casing is inconsistent in the official sources themselves: the docs heading is sv_maxClients while the example cfg writes sv_maxclients. No source states a case-sensitivity rule.
- sv_mumble is marked deprecated as "less secure than the new server Voice API."
Where the built-in commands stop
The convars above are the platform's own surface. But look at what they do: sv_entityLockdown constrains entity creation, sv_pureLevel constrains modified client files, sv_stateBagStrictMode constrains who writes state. They are structural limits. None of them watch a player and conclude that the person behind the keyboard is running a mod menu.
That gap is where a dedicated anti-cheat lives. FairShieldAC runs client- and server-side behavioural heuristics for mod menus, Lua executors, aimbot, silent aim, ESP, godmode, noclip and teleport, screens connecting players against a global HWID ban network, and uses encrypted, shuffled event triggers against event spoofing. It reports catching 98%+ of known cheats and exploits. The two layers stack; for the installation sequence, see the anti-cheat setup guide.
Frequently asked questions
What is the difference between the FiveM server console and the F8 console?
F8 opens the client console, local to one player's copy of the game, running client-registered commands. The server console (the FXServer window, txAdmin's Live Console, RCon, or server.cfg via exec) executes with full server authority. Commands typed in F8 that are registered server-side get routed to the server and permission-checked there. The reverse does not work, so the server console cannot run resmon or netgraph.
Why do I get "access denied" when running a FiveM command?
Almost always because the command is registered as restricted and your principal holds no ACE for the object command.<name>. Diagnose with test_ace, list_aces and list_principals, and enable se_debug for verbose ACL output showing which entry matched. Fix it with a narrow add_ace grant for that command. A deny entry beats any allow.
What is the difference between start, restart, ensure and refresh?
start launches a stopped resource. restart restarts a resource only if it was already started, so it does nothing to a stopped one. ensure covers both cases, restarting the resource if it was running and starting it if it was not, which makes it the safe default in server.cfg. refresh only rescans the resources folder and loads manifests so new resources become startable.
How do I see every command available on my FiveM server?
Run cmdlist. It lists the commands registered on the client or server, along with variables set using set, sets and seta. On the client it is a developer command, so it needs dev mode (+set moo 31337 or a non-production update channel) and otherwise returns an access denied error. Resources register commands at runtime.
Next step
Open your server.cfg alongside this page and ask three questions: is anything sensitive published with sets, is any ACE line broader than the command it was meant to grant, and have you reviewed each security convar rather than left it on its permissive default. That ten-minute pass removes most self-inflicted exposure. To add detection on top, compare plans, or read how detection works, how HWID bans stop repeat cheaters, and what to do under a DDoS attack.