FiveM Updated April 27, 2026

Setting Up a Server Whitelist

How to restrict server access to approved players using ESX, QBCore, or a standalone whitelist resource.

FiveMWhitelistAccess ControlESXQBCore

Overview

A whitelist prevents non-approved players from connecting to your server. FiveM does not have a built-in whitelist command in vanilla FXServer — whitelisting is handled by the framework (ESX or QBCore) or a standalone resource. This guide covers both approaches.

Identifier Types for Whitelisting

Whitelists match connecting players against stored identifiers. The supported types are:

Type Format Notes
Steam steam:HEXID Most reliable; requires Steam to be running
License license:HEXID Rockstar Social Club ID; always present
Discord discord:SNOWFLAKE Requires a Discord-auth resource

Steam hex is the most commonly used. To find a player's Steam hex:

  1. Get their SteamID64 from their Steam profile URL or a tool like steamid.io.
  2. Convert to hex (e.g., SteamID64 76561198012345678 → steam:11000010b6e7e2e).

Or read it from the txAdmin Player Manager when the player is connected.

ESX Whitelist

ESX includes a built-in whitelist system in es_extended.

Enable Whitelisting

In es_extended/config.lua:

Config.Whitelist = true
Config.WhitelistGrade = 0

WhitelistGrade sets the minimum job grade required to connect. Set to 0 to allow any whitelisted player regardless of job grade.

Adding Players

Whitelisted players are stored in the users table. The whitelist column must be set to 1:

UPDATE users SET whitelist = 1 WHERE identifier = 'steam:11000010b6e7e2e';

Or insert a new record if the player has not connected before:

INSERT INTO users (identifier, whitelist) VALUES ('steam:11000010b6e7e2e', 1);

Rejecting Non-Whitelisted Players

When Config.Whitelist = true, players not in the database with whitelist = 1 are kicked with a configurable message set in the locale file.

QBCore Whitelist

QBCore uses the qb-whitelist resource.

Installation

Install qb-whitelist from the QBCore GitHub organization and place it in resources/[qb]/qb-whitelist/.

Add to server.cfg before qb-core:

ensure qb-whitelist

Configuring qb-whitelist

In qb-whitelist/config.lua:

Config.Enabled = true
Config.Identifier = 'license'  -- or 'steam'

Adding Players

Whitelisted identifiers are stored in the whitelist database table:

INSERT INTO whitelist (name, license) VALUES ('PlayerName', 'license:a3f...');

Or use the in-game command (requires admin ACE):

/addwhitelist [player id]

Standalone Whitelist Resource

If you are not using ESX or QBCore, use a standalone whitelist resource. Many are available on the cfx.re Forum and GitHub. Most follow the same pattern:

  1. Maintain a list of approved identifiers in a config file or database table.
  2. Hook into the playerConnecting event to check the connecting player.
  3. Call the deferrals API to accept or reject:
AddEventHandler('playerConnecting', function(name, setKickReason, deferrals)
    deferrals.defer()
    local src = source
    local steamId = GetPlayerIdentifierByType(src, 'steam')
    if not IsWhitelisted(steamId) then
        deferrals.done("You are not whitelisted on this server.")
    else
        deferrals.done()
    end
end)

ACE-Based Connection Restriction

For a lightweight alternative, you can use ACE to block connections from builtin.everyone and only allow specific principals. This is rarely used in practice because it does not support per-player management at runtime, but it is effective for private development servers:

add_ace builtin.everyone command.connect deny
add_principal identifier.steam:11000010b6e7e2e group.whitelist
add_ace group.whitelist command.connect allow
Back to Knowledgebase
Need help? Submit a Ticket →