How to make a FiveM server in 2026

Most FiveM tutorials skip straight to downloading artifacts and leave you with a server that runs for a weekend and then falls apart. Before you touch a single file, get these four things sorted — they decide everything that follows.

Sign in at keymaster.fivem.net with your Cfx.re (forum) account and create a new key. You will be asked for an IP address and a server name. Use the public IPv4 of the machine the server will run on. If you are still testing locally, pick the localhost option and regenerate the key when you move to a real host.

• One key per running server. Reusing a key across two live servers gets both dropped from the server list.
• Keys are free. Anyone selling you one is selling you someone else's.
• If your host changes your IP, edit the key in Keymaster — you do not need a new one.

Artifacts are the FiveM server binaries. They ship as numbered builds from the Cfx.re runtime index. Do not blindly grab the newest one: pick a build that the resources you plan to run have actually been tested against. In 2026 most production servers sit on a recent 12000-series artifact, and a lot of long-running ESX servers are still comfortable on the 25770-era builds because every script in their stack was proven on it.

mkdir -p /opt/fxserver && cd /opt/fxserver
wget https://runtime.fivem.net/artifacts/fivem/build_proot_linux/master/<BUILD>/fx.tar.xz
tar xf fx.tar.xz && rm fx.tar.xz
chmod +x run.sh

On Windows, download the equivalent server.zip, extract it to something like C:\FXServer\server, and keep your server data (resources, server.cfg, cache) in a separate folder such as C:\FXServer\server-data. Keeping binaries and data apart means updating artifacts is a five-minute job instead of a restore-from-backup incident.

server.cfg is the boot script for your server. It sets endpoints, loads resources in order, declares ACE permissions and holds your licence key. Most leaked "base" servers ship a config full of commented-out junk and wide-open permissions. Write your own.

endpoint_add_tcp "0.0.0.0:30120"
endpoint_add_udp "0.0.0.0:30120"

sv_maxclients 64
onesync on
sv_enforceGameBuild 3407

set mysql_connection_string "mysql://user:[email protected]/fivem?charset=utf8mb4"

ensure oxmysql
ensure ox_lib
ensure es_extended

sv_hostname "My Roleplay | ESX | Custom Scripts"
sv_licenseKey "YOUR_KEY_HERE"

add_ace group.admin command allow
add_principal identifier.license:XXXX group.admin

• Load order matters. oxmysql before the framework, the framework before anything that depends on it, and UI libraries such as ox_lib early.
• Use ensure, not start. ensure restarts a resource cleanly if it is already running.
• sv_enforceGameBuild pins the GTA V build your MLOs and vehicles expect. Changing it silently breaks streamed assets.
• Never commit server.cfg to a public repository — it holds your licence key and database password.

txAdmin ships inside the artifacts and is the closest thing FiveM has to a control panel: a web UI for the console, live player list, bans, scheduled restarts, automatic backups and one-click artifact updates. Start the server once with txAdmin, complete the setup wizard, and point it at your server-data folder and server.cfg.

• Set a scheduled restart. Long-running FiveM processes leak; a nightly restart is standard practice.
• Turn on the built-in database backups if txAdmin manages your MySQL, or script your own mysqldump on a cron.
• Give staff their own txAdmin accounts with scoped permissions instead of sharing the master login.
• Bind the txAdmin port to localhost and reach it through an SSH tunnel or a reverse proxy with HTTPS. An exposed txAdmin panel is a full server takeover waiting to happen.

The framework decides your data model, your resource ecosystem and how easily you can hire a developer later. This is the single most expensive decision to reverse, so make it deliberately rather than by copying whatever base server you downloaded.

Whatever you pick, install the framework's own SQL file into your database before starting the server, and read its documentation on how it expects identifiers to be configured. Mismatched identifier settings are the reason characters "disappear" after a restart.

oxmysql is the standard database layer in 2026. It is asynchronous, it supports prepared statements, and it gives you per-query timing in the console — which you will need the first time someone reports lag.

-- Good: parameters are escaped by the driver
local row = MySQL.single.await(
  'SELECT money, job FROM users WHERE identifier = ?',
  { identifier }
)

-- Never do this. It is an injection waiting to happen.
-- MySQL.query.await('SELECT * FROM users WHERE identifier = "' .. identifier .. '"')

• Add indexes on every column you filter by — identifier, owner, citizenid, plate. A missing index on a table with 50k rows is a visible freeze.
• Use utf8mb4 everywhere, or emoji in character names will corrupt your tables.
• Set up automated dumps to somewhere that is not the same machine. A backup on the server you just lost is not a backup.

OneSync Infinity lifts the player cap far past the legacy 32 and moves entity ownership to the server. It also changes the rules you have to write code by. Client-side assumptions that worked on a 32-slot server quietly break at 100 players.

• Entities are not guaranteed to exist on every client. Always check DoesEntityExist and use networked IDs, not local handles, across the client/server boundary.
• Use state bags for shared entity state instead of broadcasting events to everyone.
• Routing buckets isolate players — use them for interiors, instanced heists and admin areas rather than teleporting people far away.
• Population and entity limits are configurable, and defaults are generous. Tune them down before you fight symptoms.

Every server-side event you register is a public API that any connected client can call with any arguments. Treat it that way. The most common exploit on a fresh server is not a fancy injector — it is a client calling your own money event with a number of its choosing.

RegisterNetEvent('shop:buy', function(itemName, amount)
  local src = source
  amount = tonumber(amount)

  -- type + range checks
  if type(itemName) ~= 'string' or not amount or amount < 1 or amount > 100 then
    return DropPlayer(src, 'Invalid request')
  end

  -- the price comes from the server, never from the client
  local item = Config.Items[itemName]
  if not item then return end

  -- and proximity is verified server-side
  local ped = GetPlayerPed(src)
  if #(GetEntityCoords(ped) - Config.ShopCoords) > 5.0 then return end

  -- only now touch the player's money
end)

• Never trust a price, a coordinate, a player ID or an item name sent by a client.
• Rate-limit events that can be spammed. A loop calling your event 500 times a second is a denial of service.
• Keep sv_scriptHookAllowed off and run a maintained anti-cheat, but understand it is a second layer — not the first one.
• Audit any leaked or bought script before you run it. Obfuscated Lua in a "free release" is very often a backdoor.

A server that technically boots is not a server that is ready for players. Run through this list before you post your first advert.

1. 1Load-test with bots or a stress event. Watch server ms and resmon while it happens, not afterwards.
2. 2Confirm every restart preserves character data — kill the process, do not just use txAdmin's clean restart.
3. 3Write the rules, the ban appeal path and the staff escalation process before you need them.
4. 4Set up a Discord with role-gated channels, a ticket system and a public status channel.
5. 5Give the server a real identity: a custom loading screen, a branded minimap and a consistent name across the server list, Discord and your website.
6. 6Have a rollback plan. Know exactly which command restores yesterday's database.

1. 1Starting from a leaked base. You inherit someone else's bugs, someone else's backdoors, and no idea how any of it works.
2. 2Installing 200 scripts before opening. Every resource is a permanent maintenance cost. Open with 30 you understand.
3. 3Never profiling. If you have not run resmon under load, you do not know what your server is doing.
4. 4Treating the database as an afterthought until the first data loss.
5. 5Launching without a hook. "Serious RP, custom scripts" describes four thousand other servers. Say what is actually different.