License and upgrade

Keep credentials on the server#

Keep licenses and long-lived panel keys on the server: use set in server.cfg or configs/anticheat_server.lua. Leave ts.webPanelKey, ts.Central.token and ts.licenseLock.licenseKey blank in shared configs/anticheat_config.lua. NUI, client events and public repositories must not contain secrets. Short-lived screenshot/video tokens authorize scoped evidence uploads only; they do not grant a license or package-download permission.

Read the official Cfx guide

Upgrade and rotate older keys#

Replace old resource files with the 9.6.24 package and restart the updated resources during maintenance. Older releases may have exposed long-lived panel keys to clients. After every old instance is stopped, rotate the affected license and legacy panel/API keys in coordination with the administrator, update the server-side settings and verify the connection. Installing the update alone does not revoke previously exposed keys.

The license key is required#

Packages downloaded from 7 October 2026 do not run the anticheat without this server's license key. Without a key, or with another server's key, the server refuses players, drops online players and prints the reason in the console.

Copy the key from the Servers page in the panel and add it to server.cfg before the ensure lines: set tosun_ac_license "SERVER_LICENSE". The licenseKey field in configs/anticheat_server.lua also works. A key entered later (a late server.cfg line or set in the console) opens the server to players without a restart.

If you rotated the license in the panel, the old package no longer matches the new key; download and install the package again.

Choose the right credential for the job#

A Tosun server license identifies a registered server and is separate from FiveM’s sv_licenseKey. Component API credentials can have their own scopes. Evidence-upload credentials are short-lived and tied to upload context. Do not exchange these values just because each is called a key: a valid upload token does not grant panel administration or authorize a database bridge.

Open Servers, select the intended server and copy its current license into server.cfg with set. Replace the placeholder; do not use the literal example value. Keep the setting on the server and outside NUI, shared/client Lua and public repositories. The same server license is used by the bridge, while panel actions still require your account’s permissions.

set tosun_ac_license "YOUR_SERVER_LICENSE"

• API credentials

Upgrade files and verify what actually runs#

Before an upgrade, save the working resource and editable settings. Download the package for the selected server, compare its integration notes and replace the intended installation in maintenance. Check that there is only one active copy: leaving an older resource running can preserve the old behavior even when new files exist elsewhere.

A local format or license-lock check is not a receipt proving the subscription is paid. Review the account’s real subscription and server status when an API reports an inactive tenant or suspended server. Do not hide an authentication error by turning protection off.

1. Compare the running manifest version and startup output with the package you downloaded.
2. Merge your supported configuration changes, then check custom teleport, inventory and staff integrations.
3. From 9.6.14 the panel connection and online balance editing are on by default. Old set tosun_db_bridge_enabled and set tosun_db_bridge_money_write lines are ignored and can be deleted; packages older than 9.6.14 still need them. If you had the connection or balance editing off before, use “Disable connection” on the server’s Tosun Connect card, or manual mode (set tosun_db_bridge_manual "1"), where the server.cfg values apply as before. Confirm the connection with a small read and check normal gameplay before staff edit balances.

• Installation acceptance checks

Rotate a disclosed key without leaving an old copy#

If a license was posted publicly or an older integration sent a long-lived key to clients, assume that copying new files has not revoked that value. Regenerating the server license in Servers replaces it; update the protected server setting and verify the connection. Coordinate any separate panel/API-key rotation with the administrator.

When payment is overdue, use Billing to inspect the outstanding invoice and its current payment action. A key rotation is not a payment repair. If the provider result is unclear, verify invoice state before paying again; give support the invoice reference and sanitized server error instead of the license.

• Identify every running instance and integration using the affected key; stop outdated copies before rotation.
• Remove secrets from repository history, screenshots, backups offered publicly and support attachments where possible.
• Install the current key only in the necessary server configuration; never include it in a diagnostic command shared with others.
• Keep a private note of server ID, time and sanitized error if reconnecting fails. Check the selected server and paid status before requesting another key.

• Troubleshooting

Plan credential rotation as a maintenance change#

Start by matching the selected server name and ID in the panel to the running installation. Record when the console error began, the current resource version and who can access its configuration. An overdue subscription, selection of the wrong server and failure to reach the service require different remedies. A connection failure alone does not establish that a credential has leaked.

When rotation is necessary, use the license regeneration action for the selected record in Servers. This changes the key on the same server record; adding a replacement server is unnecessary and may consume quota. Stop resource copies and private integrations using the previous value, update the protected server.cfg and restart according to your maintenance plan. Never copy the long-lived value into browser code.

Keep the server identity when reinstalling files#

Reinstalling the resource and deleting its server record from the panel are different operations. If files are damaged, download the package for the correct existing record again and keep an independent backup of editable configuration. Store the old directory outside the active resource path. Starting two copies makes the effective settings difficult to identify.

Compare the new package manifest version, dependency order and local configuration. After startup, inspect the corresponding server status in the panel. If the database bridge is enabled, use one small read to check authorization; no balance change is needed. Accept the reinstall when the correct record, one active copy, expected version and representative normal gameplay have all been confirmed.

Build a useful connection incident record#

Include the server ID, resource version, first error time, last successful connection and sequence of configuration changes in a support request. Distinguish an authorization rejection from a network failure. Remove the license, Authorization headers, database connection strings and personal information before sharing console output. A short relevant excerpt is preferable to an entire private backup.

Do not restore a compromised old key after rotation. If resource files must be rolled back, put the currently valid credential into the restored configuration. Fix the source of disclosure too: changing a key while leaving a public repository exposed repeats the incident. Finish with a dated record confirming connectivity, stopped obsolete copies and removal of unnecessary access.

Read license sessions during a machine migration#

Stop the old running copy before moving to another machine. Compare fingerprint, last IP, version and last-seen information in the download page license sessions with your migration record. These represent server installation sessions, not player account sessions. Releasing the wrong row can affect another active installation; do not clear every record merely because several are listed. Creating another panel server does not replace management of the previous license session and can affect a separate quota.

After stopping the old machine, release its matching session through the panel action. An old running copy can register again during a later check, so stopping it matters. Current policy can free inactive active sessions after about twenty minutes; explicitly revoked sessions are not treated as automatically expired. For seat_taken, inspect usage and the correct row instead of treating license_rotated or subscription errors as the same problem. Verify the new machine through startup output, its session and ordinary connection.

Packages downloaded before 7 October 2026 could send a different server fingerprint on every license check. The server then saw its own session as a second server, received seat_taken and stopped accepting players a few minutes after each start ("Lisans dogrulanamadi"). The license service accepts these packages again until 5 November 2026: restart the resource once, then download the package again before that date to receive the corrected license client.

Interpret Build ID and license_rotated together#

The Build ID in download history identifies a distributed package record, not the license itself. Match the filename version and Build ID prefix to that record. A different server’s package remains wrong even under a similar filename. unknown_build, revoked, license_mismatch and license_rotated describe different binding checks. Generating another key for every message obscures diagnosis. Preserve the exact result while excluding private license values and package credentials from reports.

For example, regeneration in Servers leaves previously distributed packages bound to the old license digest. Changing server.cfg alone does not update that binding. Download a current package from the same correct server record and update the protected setting. Do not assume an old-key package will work when rolling back. Build history supports tracing distribution but does not prove who personally shared a copy. Accept the change only after matching the current package and key with successful licensing; verify billing separately.

Understand what each protection layer provides#

A Tosun package does not require a Tebex or Asset Escrow account. The ordinary Cfx.re server license for FiveM is separate. Signatures, encrypted storage and Lua obfuscation serve different purposes; none should be described as unbreakable source confidentiality.

AES-256-GCM storage protects the archived ZIP on the distribution server. It does not hide downloaded files from the owner of the game server where they run.

Ed25519 verifies that a license response came from the authorized signer and belongs to the expected request and package context. The private signing key is not shipped in the package. SHA-256 file digests detect changed core files; they do not encrypt the file contents.

Lua obfuscation adds friction to reading and copying, but is reversible. A person controlling their game server can read or modify local files. Keep authoritative permission decisions on the server and do not share packages or licenses.

A Build ID helps inspect a distribution record; it is not proof of who leaked a copy. A network outage or unauthenticated response is not equivalent to an authenticated license denial. Preserve that distinction in a support report.

Plan updates and rollback deliberately#

Downloading provides a package; it does not automatically update your installed FiveM resource. Record the version, Build ID and selected server binding before maintenance. The source contents can change without a version label change, so filenames alone do not establish that two packages are identical.

Download from the same server record. A valid cached package may keep the same Build ID. Downloading does not renew a subscription or automatically rotate its license.

Editing protected core files can fail integrity checks. Use editable files and documented export/bridge integration points. Disabling the signature verifier or license code is not a repair procedure.

After license rotation, changing only server.cfg may not make an old license-bound package valid. A rollback must account for the package, current license binding and configuration together.

1. Back up existing resources, configs, admins, editable, bridge and your locale changes. Keep secret backups outside public web directories.
2. Extract the correct package during maintenance. Compare settings instead of overwriting the new shared configuration with the entire old file.
3. Keep secrets in server-only settings, verify shared fields are blank and preserve dependency order.
4. Check startup, normal player login, administrator access and a small panel read. Do not use a real ban or economy change as an installation test.
5. Record the first failure and its time. Distinguish license_rotated, revoked, seat_taken and network errors rather than treating all as the same license problem.

Copy the Tosun license for the selected server#

Open Servers in your TosunDev account, select the FiveM server you are installing, and copy that record’s Tosun AC license. A tac_live_ Tosun license is different from a Cfx.re server license, sv_licenseKey, a Discord bot token and the panel API key. Each credential belongs in its own field.

1. Replace YOUR_SERVER_LICENSE inside the quotes of tosun_ac_license in server.cfg; do not leave the placeholder unchanged.
2. Place the setting before ensure tosun-ac. Use server-only set, never setr or sets.
3. Alternatively fill credentials.licenseKey in configs/anticheat_server.lua. A nonempty server.cfg convar takes precedence over that file.
4. Keep licenses out of screenshots, chat, shared config and client files. Copy the license of the selected server, not another server.

set tosun_ac_license "YOUR_SERVER_LICENSE"
# Alternative: configs/anticheat_server.lua
# credentials.licenseKey = "YOUR_SERVER_LICENSE"