PiTyUs.Hire me

Engineering

Convars in FiveM: configuration that lives in server.cfg

How FiveM console variables work: set vs sets vs setr, reading them with GetConvar and GetConvarInt, replicated convars on the client, keeping secrets server-only, and using convars to configure your own resources.

Updated 9 min readBy PiTyUs · FiveM developer

Overview

Convars — console variables — are the settings in server.cfg: the connection string, the server name, the licence key and dozens of resource options. The three ways to set one (set, sets, setr) decide who can see it, which is the difference between a working config and a leaked password.

set, sets and setr

CommandVisible toTypical use
setThe server onlymysql_connection_string, API keys, private options
setsServer and the public server listsets tags, sets locale, sets banner_detail
setrServer and every connected clientOptions client scripts need, e.g. setr inventory:imagepath
server.cfgcfg
set mysql_connection_string "mysql://fivem:[email protected]/fivem"   # private
sets tags "roleplay, serious, economy"                            # public listing
setr ui:accent "#5b6af0"                                         # clients can read it

Reading convars in scripts

server.lua / client.lualua
local accent  = GetConvar('ui:accent', '#ffffff')      -- string
local slots   = GetConvarInt('myhud:slots', 5)         -- integer
local webhook = GetConvar('mylogs:webhook', '')        -- server only: set with `set`

if webhook == '' then
    print('^3mylogs: no webhook configured^7')
end

A client can only read convars set with setr. Reading a plain set convar on the client returns the default — which is exactly the protection you want for secrets.

Convars for your own resources

Reading options from convars lets server owners configure your resource from server.cfg without editing its files — which means updates never overwrite their settings. Prefix names with the resource (mylogs:webhook) to avoid collisions. Keep a documented list of the convars your resource reads; see script documentation.

Secrets

Many servers keep secrets in a separate cfg file that is not committed to version control and exec it from server.cfg — see Git for FiveM.

Frequently asked questions

What is the difference between set, sets and setr?

set is server-only, sets is also shown in the server list, and setr is replicated to clients so client scripts can read it.

How do I read a convar in Lua?

GetConvar('name', 'default') for strings and GetConvarInt('name', 0) for integers.

Why can my client script not read my convar?

It was set with set. Only setr convars are replicated to clients.

Is it safe to put a Discord webhook in a convar?

Yes, with set and read only on the server. Never with setr or sets.

Need this built, not just explained?

Ten years of FiveM work, from Lua to NUI

Custom resources, React NUI, ESX / QBCore / Qbox integration, OneSync performance audits and security reviews — plus the websites and SEO around your server brand.

Related guides