Engineering
Convars in FiveM: configuration that lives in server.cfg
How FiveM console variables work: set vs sets vs setr, reading them with GetConvar and GetConvarInt, replicated convars on the client, keeping secrets server-only, and using convars to configure your own resources.
Overview
Convars — console variables — are the settings in server.cfg: the connection string, the server name, the licence key and dozens of resource options. The three ways to set one (set, sets, setr) decide who can see it, which is the difference between a working config and a leaked password.
set, sets and setr
| Command | Visible to | Typical use |
|---|---|---|
set | The server only | mysql_connection_string, API keys, private options |
sets | Server and the public server list | sets tags, sets locale, sets banner_detail |
setr | Server and every connected client | Options client scripts need, e.g. setr inventory:imagepath |
set mysql_connection_string "mysql://fivem:[email protected]/fivem" # private
sets tags "roleplay, serious, economy" # public listing
setr ui:accent "#5b6af0" # clients can read itReading convars in scripts
local accent = GetConvar('ui:accent', '#ffffff') -- string
local slots = GetConvarInt('myhud:slots', 5) -- integer
local webhook = GetConvar('mylogs:webhook', '') -- server only: set with `set`
if webhook == '' then
print('^3mylogs: no webhook configured^7')
endA client can only read convars set with setr. Reading a plain set convar on the client returns the default — which is exactly the protection you want for secrets.
Convars for your own resources
Reading options from convars lets server owners configure your resource from server.cfg without editing its files — which means updates never overwrite their settings. Prefix names with the resource (mylogs:webhook) to avoid collisions. Keep a documented list of the convars your resource reads; see script documentation.
Secrets
Many servers keep secrets in a separate cfg file that is not committed to version control and exec it from server.cfg — see Git for FiveM.
Frequently asked questions
What is the difference between set, sets and setr?
set is server-only, sets is also shown in the server list, and setr is replicated to clients so client scripts can read it.
How do I read a convar in Lua?
GetConvar('name', 'default') for strings and GetConvarInt('name', 0) for integers.
Why can my client script not read my convar?
It was set with set. Only setr convars are replicated to clients.
Is it safe to put a Discord webhook in a convar?
Yes, with set and read only on the server. Never with setr or sets.
Need this built, not just explained?
Ten years of FiveM work, from Lua to NUI
Custom resources, React NUI, ESX / QBCore / Qbox integration, OneSync performance audits and security reviews — plus the websites and SEO around your server brand.
Related guides
- EngineeringKVP storage in FiveM: saving small data without a databaseSetResourceKvp(key, value) stores a string (or SetResourceKvpInt/Float for numbers) scoped to the resource; read it back with GetResourceKvpString, GetResourceKvpInt or GetResourceKvpFloat, and remove it with DeleteResourceKvp. On the client it is stored on the player’s PC for your server; on the server it is stored with the server. Use it for small, simple values, not for shared or valuable data.
- EngineeringFiveM server securityEvent validation, trust boundaries, backdoored resources, txAdmin hardening and what anti-cheat can and cannot do.