Installation

1. Prepare the server#

Use a supported FiveM artifact and review OneSync requirements for your server. Keep the working oxmysql connection. Extract tosun-ac under resources without renaming it. Start your framework and required dependencies first. The anti-cheat needs local database permission to create its required tables on first start. The bridge needs no separate SQL import; use a supplied install SQL file only after a backup if troubleshooting a missing table.

2. Add the server-only settings#

Select the correct server in Servers. Before resources start, use set tosun_ac_license in server.cfg; this is the only required line. set tosun_ac_panel_key and set tosun_ac_central_token are optional; add them only if you want to set those keys manually. Do not use setr or sets. Alternatively edit the credentials table in the server-only configs/anticheat_server.lua. Shared/client credential fields stay blank. Detailed download and migration steps follow below. The panel data connection (bridge) is on by default, so the example has no bridge line; older tosun_db_bridge_enabled and tosun_db_bridge_money_write lines are ignored and can be deleted.

set tosun_ac_license "YOUR_SERVER_LICENSE"
ensure oxmysql
ensure tosun_render
ensure tosun-ac
ensure tosun-ac-guardian

3. Start and verify#

Start oxmysql before tosun-ac in a planned maintenance window. Check the resource version and server console for dependency or authentication errors. The bridge starts on by default and needs no extra server.cfg line; check it with the server console command below. Never paste a real key into a support ticket. Verify the bridge read result separately: query_timeout does not prove SQL cancellation, and query_busy does not mean another query was started. Follow the database guide for timeout and scope checks.

tosunac_db_status

Prepare a recoverable installation#

Before changing a working server, record its artifact, framework and inventory resource names. Download the package for the exact server selected in Servers; another server’s package or license can connect the wrong installation. Confirm the paid subscription and that your account can manage this server. Keep the ZIP private rather than uploading it to a public file host.

1. Back up the current tosun-ac directory, editable configuration and game database. Check that the backup can be accessed before replacing anything.
2. Extract the new package into a separate directory. Check that fxmanifest.lua sits directly inside tosun-ac, not inside a second nested tosun-ac directory.
3. Compare editable settings with the new defaults. Carry over intentional changes and integrations; do not replace the whole new configuration with an old copy.

• License and upgrade

Configure dependencies and private settings#

Keep the game database connection that already works with oxmysql. The panel database bridge and online balance editing are on by default, so the example has no bridge lines; older tosun_db_bridge_enabled and tosun_db_bridge_money_write lines are ignored and can be deleted. Insert your existing framework and inventory start lines in their normal dependency order. Do not start multiple conflicting framework variants just to satisfy an example. The license uses set because setr replicates a value to clients and sets publishes server information.

The resource requires database access for its own tables. First-start table setup is separate from the bridge. To turn the bridge off for one server, use Panel → Servers → the server → Tosun Connect → Disable connection. For manual control, add set tosun_db_bridge_manual "1"; tosun_db_bridge_enabled and tosun_db_bridge_money_write are then read from server.cfg, and each is off unless set to "1". Do not import SQL blindly into a populated database, and do not put database passwords or the Tosun license into shared/client Lua. Use a planned maintenance window: ensure can restart an already running resource.

set tosun_ac_license "YOUR_SERVER_LICENSE"

ensure oxmysql
# Start your existing framework and inventory here.
ensure tosun_render
ensure tosun-ac

• Official server commands
• Database bridge

Check ordinary gameplay before reopening#

A running resource alone does not prove that every integration is correct. Check the manifest version, startup output and connection status, then join with a test account. Run these diagnostic commands in the server console; the bridge is on by default, so a disabled status is expected only in manual mode without tosun_db_bridge_enabled "1" or while the legacy panel mirror is enabled. The config doctor reports risky settings after settings are applied and does not edit them.

Keep a short acceptance record: package version, test time, responsible administrator and the workflows checked. If only a custom script fails, reproduce that action with a test player and record its resource name. Review that integration before giving every player a broad exemption or raising punishments across the server.

• Character selection, spawn, hospital revive, house entry and garage exit work without unexpected punishment.
• A legitimate inventory weapon, police loadout and any arena weapon follow the intended weapon check or scoped allowance.
• Normal emote props, phone menus and staff actions work; logs identify any specific resource needing integration.
• If startup fails, capture the first relevant error and installed version, restore the saved resource if needed, and remove keys before sharing logs.

tosunac_integration
tosunac_doctor
tosunac_db_status

• Integrate custom scripts
• Settings and performance

Update one resource without mixing two packages#

Treat the update as a small change with a clear before and after. Keep the resource folder name tosun-ac so existing exports and helper paths still point to the same resource. Compare configs/anticheat_config.lua, configs/anticheat_webhooks.lua and your editable integrations with the new package, and copy only intentional settings. Preserve the current server-only convars and reviewed trust-list entries. From 9.6.14, the tosun_db_bridge_enabled and tosun_db_bridge_money_write lines in server.cfg are ignored, so the bridge and online balance editing for panel admins and owners are on after the update. To keep the bridge off, use Disable connection on the server’s Tosun Connect card, or add set tosun_db_bridge_manual "1"; those lines then apply again, and each is off unless set to "1". An old configuration can omit new defaults, while copying a whole old directory can leave obsolete modules beside new ones. Start order must still place oxmysql and the relevant core before tosun-ac, and dependent integrations after it.

1. Close new joins during the planned change and record the first startup output, installed version and configuration differences.
2. Use one active tosun-ac folder; keep the backup outside the active resources tree to avoid starting it accidentally.
3. Reconnect a normal test player after restarting; a client still running the previous session is not a clean acceptance test.

Choose the diagnostic branch from the symptom#

Begin with the first concrete failure rather than changing several protections together. If the resource does not start, inspect the folder layout, manifest and missing dependency error. If it starts but cannot link to the panel, check the selected server, license and connection status before investigating a gameplay rule. A launcher admission rejection is another gate and must be investigated through its own status. If only one house, arena or clothing script fails, capture that resource and action and inspect integration rejection output. A staff account may be exempt, so its successful test cannot establish that an ordinary player is handled correctly.

1. Reproduce the smallest failing action once with a normal test character and note the exact console or panel result.
2. Compare the same action with its last working configuration; correct the responsible dependency or integration, then repeat that test.
3. Keep private keys out of the report. Do not disable trust enforcement or every detection to make one symptom disappear.

Restore a known state and recheck it#

Plan rollback before the update window. Keep a matching resource and configuration backup, the previous start order, and a record of intentional convar changes. If a new version prevents normal joining or a required workflow, return to that known package during maintenance and verify it again. Restoring Lua files does not undo a money change, delete a panel job or restore database contents. Do not drop AC tables or erase ban and detection history as an installation repair. If a database change is involved, have its maintainer assess a separate restore plan against data written since the backup.

1. Restore only the affected resource and configuration first, then check startup, ordinary joining and the previously failing action.
2. Balance editing is on by default. Until the restored setup and any uncertain balance operation have been reviewed, turn the connection off on the server’s Tosun Connect card, and check the in-game balance before sending an edit again. After the review, turn it back on with Enable connection on the same card. A restored package older than 9.6.14 keeps the old behaviour: the bridge stays off unless its server.cfg lines are set.
3. Document what was restored and why, so the next update can address the reproduced cause instead of repeating the same broad changes.

Inspect the extracted directory layout#

Extract the archive into a separate working directory first. Check for accidental nesting such as tosun-ac/tosun-ac, confirm fxmanifest.lua is at the resource root, and retain a separate tosun-ac-guardian folder if supplied. Do not flatten files by extension: the manifest loads client, shared, configs, editable, server and html paths. A configuration copied to the machine may still be unused if it is outside its expected path. Find this before restarting.

An @oxmysql/lib/MySQL.lua error calls for a dependency check rather than license rotation. For missing html/index.html, inspect NUI files and layout. Record the missing path and restore it from the correct package instead of mixing a single module from another version. Review any optional INSTALL.sql against the existing schema with a backup before applying it. The downloaded archive, prepared folder and selected active resource should form one clear installation chain; prioritize the first startup error.

Check which side loads confidential settings#

A filename alone does not determine what players receive. configs/anticheat_config.lua appears under shared_scripts and loads on both server and client. Do not add a license, private API credential or database password to that table for convenience. Client files and html/NUI content are not secret storage either. Editable readable configuration does not mean every field is appropriate for credentials; distinguish normal settings from server-only identity.

Inspect the locations of secrets in files you changed. Keep the license in protected server.cfg using server-only set, never setr or sets. Use the package server-side configs/anticheat_webhooks.lua path for webhook configuration, masking its address in screenshots. If a secret reached a public/client file, deleting it now does not withdraw earlier distributions; assess credential replacement. Record that the correct file and loading side were verified, without copying the secret value into the acceptance note.

Advance through small startup acceptance gates#

Run maintenance through four stages: the existing database connection and core, AC startup, normal player flow, and the panel bridge, which is on by default. Do not open the next stage until the current result is visible. First check normal functions of the framework and inventory already in use; adding another core can hide the cause. Next match active tosun-ac output to the installed package. Test ordinary player flow with a character that does not benefit from staff exemptions. Online balance editing for panel admins and owners is also on by default; checking the bridge with a read does not require changing a balance.

Record time, expected result and observed result in one line for each gate. If character selection works but leaving a garage fails, return to the first broken workflow instead of downloading everything again. Working gameplay and a completed bridge read are separate acceptance results. Temporarily suppressing a message does not make the preceding gate pass. Resolve the missing dependency before advancing, and resume normal use after the necessary gates are verified. The record keeps completed and pending stages clear.

Interpret console messages together with their outcome#

Colored startup messages do not all mean the same thing. A weapon/inventory check waiting for a supported inventory is not a cheat detection against a player; examine the provider and core state. A missing GetSelectedPedWeapon message says that module cannot run its required native, not that every module is disabled. Integration output showing enforce and trusted describes caller policy; it does not prove a gameplay workflow works. Start from the complete message rather than relying on its color.

The bridge Connected message confirms health communication; a character query must separately complete. Waiting: oxmysql_unavailable points to dependencies, while Panel unavailable or not authorized requires connectivity or authorization investigation. The latter alone does not prove a broken license. The bridge is on by default, so enabled=false in the status command is expected only in manual mode without tosun_db_bridge_enabled "1" or while the legacy panel mirror is enabled. If the connection was turned off on the Tosun Connect card, the status command still shows enabled=true and the panel rejects the server’s requests; the last panel state may then show only Panel unavailable or not authorized. When you see that message, first check that the server’s Tosun Connect card shows the connection on, then check the license and network. Keep the first preceding error, resource name, time and current action with a support note. Distinguishing startup warnings from player sanctions makes diagnosis clearer.

Download through your session for the correct server#

Use the signed-in panel account that has the paid download entitlement and permission to manage the selected server. A server name, license and package record are different identifiers. Select the correct record before downloading; sharing a license or link does not safely grant another person download access.

Sign in and complete two-factor verification if your account requires it. Check that Servers and Downloads refer to the same server. An active paid service does not authorize use of a different server’s package.

The Download action creates a single-use ticket bound to the session, user, organization and server. It expires after 90 seconds. A repeated POST cannot reuse a consumed ticket. If the license, package sources or distribution context change after issuance, obtain a fresh ticket.

Download the ZIP to your own computer, then transfer it to the game server. This does not automatically replace the running FiveM resource. With JavaScript disabled, use the Download package button on the form’s next page; return to Downloads instead of resubmitting an old form.

1. Open Downloads and verify the selected server and your download entitlement.
2. Press Download once and check that the ZIP finishes downloading.
3. For an expired or consumed ticket, reload the page and obtain a new ticket. Never store the ticket or session cookie in an installation script.
4. For a login or permission error, check the panel session and server-management permission first. Do not retry an unavailable distribution endpoint in an automatic loop.
5. A license in a URL, Bearer header or X-License-Key does not authorize a package download. Do not put the panel password in an updater.
6. Record the source version and Build ID for maintenance. Do not attach the package or credentials to a support message.

Move shared credentials into server-only settings#

The public panel URL and normal game settings may remain shared; long-lived credentials must not. The new configs/anticheat_server.lua loads credentials on the server. Use set in server.cfg or edit its credentials table. Avoid configuring a secret in several places, which makes later changes difficult to trace.

Resolution uses a nonempty server convar first, then the server-only file, then the temporary legacy shared value. Legacy shared fallback is migration compatibility on the server, not the installation path for new setups. If a migration warning appears, move the secret into a server setting and clear the shared field.

The editable file exposes credentials.panelKey, credentials.centralToken and credentials.licenseKey. Configure the panel key your connection uses and leave unused central connections blank. A nonempty convar overrides the value in this file.

Deleting a secret from a file does not revoke copies already sent to players or published in a repository. Stop old copies, rotate the credential in the appropriate authorized panel screen and install the replacement on the server only. Keep configuration backups private.

1. Back up server.cfg and editable configuration privately before changing credentials.
2. Replace placeholders in the example with your own values. Do not use setr or sets for secrets.
3. Leave ts.webPanelKey, ts.Central.token and ts.licenseLock.licenseKey blank in shared configuration. Do not make a client-side copy.
4. Restart resources during maintenance and check the source version, license result and panel connection separately.
5. For support, provide the time, version, Build ID and a secret-free error code, not the credential.

set tosun_ac_license "YOUR_SERVER_LICENSE"
set tosun_ac_panel_key "YOUR_PANEL_API_KEY"
# Optional: only configure a central connection you use.
set tosun_ac_central_token "YOUR_FIVEM_CENTRAL_TOKEN"
ensure oxmysql
ensure tosun_render
ensure tosun-ac
ensure tosun-ac-guardian

Diagnose Guardian startup and deliberate stops#

In the txAdmin server console run tosunac_doctor, then tosunac_guardian_status. ready means the target resource started; waiting_dependency identifies a dependency problem; transition means start/stop is in progress; held means a deliberate temporary hold. These states do not prove gameplay protections or SQL schema tests passed.

Start oxmysql and tosun_render before tosun-ac, then start tosun-ac-guardian. Correct license/version errors before resume. Console-only pause lasts at most 30 minutes. Guardian avoids repeated ensure calls for missing/transitioning resources and bounds failed attempts with backoff.

# txAdmin server console:
tosunac_doctor
tosunac_guardian_status

# Pause only during planned maintenance; repair the reported cause first:
tosunac_guardian_pause 300
tosunac_guardian_resume

Discover events after dependencies, then review the result#

EventScanner starts after 30 seconds by default, runs hourly, and may be run manually with tosunac_eventscan from the server console. tosunac_setup is a separate maintenance operation: it waits for completed backdoor and signature checks and a matching fresh resource fingerprint before approving eligible clean, started resources. It is not a certificate that the server contains no backdoor. Work on a reviewed installation and retain a backup. Event discovery does not register a permission validator, rewrite a raw handler or authorize a player.

# txAdmin server console: event discovery only
tosunac_eventscan

What an unchanged scan cache does and does not skip#

An unchanged resource and analysis policy reuse the previous analysis result, but files still need a content fingerprint check; this is not zero disk work. Changed content or policy invalidates that reuse. Backdoor checks start after 25 seconds and repeat every 30 minutes; resource checks start after 20 seconds and repeat every 90 seconds; event discovery starts after 30 seconds and repeats hourly. Signature startup checking still runs with signatureScanFirstRun enabled, including installations with an old first-run marker. A partial, unreadable, unsupported glob or escrow-only scan is not a clean full scan and cannot justify automatic baseline approval.

-- Edit the existing configs/anticheat_config.lua tables.
ts.EnforceExportCallerWhitelist = true
ts.EventScanner.autoProtect = false
-- 0 disables only the periodic event scan, not initial/manual discovery.
-- ts.EventScanner.scanIntervalMs = 0

Accept the integration with an ordinary player#

Use an ordinary account without staff or player-whitelist relief. Test character selection, appearance changes, revive, a validated house teleport, garage exit and the custom reward once. Then test cancellation, disconnect, restarting AC and rejecting an unauthorized request. Inspect the actual export return and application receipt separately. Confirm that a legitimate camera/movement grace does not disable weapon or event checks. Keep sensitive server workflows on trusted exports; local client grace is not a promise that every directly signed detector is paused. Record the version, source name, expected result and observed result without keys or passwords.

Copy the Tosun license for the selected server#

Open Servers in your TosunDev account, select the FiveM server you are installing, and copy that record’s Tosun AC license. A tac_live_ Tosun license is different from a Cfx.re server license, sv_licenseKey, a Discord bot token and the panel API key. Each credential belongs in its own field.

1. Replace YOUR_SERVER_LICENSE inside the quotes of tosun_ac_license in server.cfg; do not leave the placeholder unchanged.
2. Place the setting before ensure tosun-ac. Use server-only set, never setr or sets.
3. Alternatively fill credentials.licenseKey in configs/anticheat_server.lua. A nonempty server.cfg convar takes precedence over that file.
4. Keep licenses out of screenshots, chat, shared config and client files. Copy the license of the selected server, not another server.

set tosun_ac_license "YOUR_SERVER_LICENSE"
# Alternative: configs/anticheat_server.lua
# credentials.licenseKey = "YOUR_SERVER_LICENSE"

From the ZIP to a started txAdmin resource#

Copy tosun-ac, tosun-ac-guardian and tosun_render into the same level under resources. Each resource needs fxmanifest.lua at its root. discord-bot is a Node.js application rather than a FiveM resource. The updated Render manifest declares gta5 only; do not carry the old common plus gta5 manifest forward.

1. Preserve the working mysql_connection_string. Start oxmysql and your existing framework/inventory before Render, AC and Guardian.
2. Run refresh in the txAdmin console and follow the startup order below. The tosun-render alias is supported; the canonical folder remains tosun_render.
3. Run tosun_render_status and check started and asset availability. Then test live capture with a player; a resource status check alone cannot prove video capture.
4. Read the first failure: missing dependency requires a dependency check; could not find resource requires a folder check; a license failure requires checking the selected server and credential.

set tosun_ac_license "YOUR_SERVER_LICENSE"

ensure oxmysql
# Start your existing framework/inventory here.
ensure tosun_render
ensure tosun-ac
ensure tosun-ac-guardian

# txAdmin console:
tosun_render_status
tosunac_doctor
tosunac_db_check
tosunac_db_status

Avoid unnecessary analysis after a restart#

Each startup checks resource content SHA256 fingerprints. Resources whose files and scan policy are unchanged reuse authenticated server KVP results instead of repeating expensive signature and event analysis. Changed files, exceptions or scan rules invalidate the affected analysis. Fingerprint checks still read files; no fixed resmon figure is guaranteed.

1. Keep the KVP cache during a normal update; corrupted or unverifiable entries are analyzed again.
2. The startup catalog collects literal event names declared in Lua/JS files. Dynamic names, unreadable or escrow files and DLLs are not certified as completely scanned.
3. Manual automatic setup waits for security analysis. Incomplete, suspicious, changed or timed-out resources are never automatically approved.
4. Test player joins, normal gameplay and admin actions on a staging server, and interpret resmon alongside player count and framework load.