server.cfg, convars and permissions

Where configuration lives#

Tosun AntiCheat reads settings from server.cfg, four files in the resource and the web panel. Credentials belong only in server-only places. configs/anticheat_config.lua is a shared script, so the server sends it to every client.

• Installation
• Panel setup
• License key

Full server.cfg example#

A complete block for a typical install. Order matters: dependencies and credential convars must come before ensure tosun-ac, because the credentials are resolved once when the resource loads. Lines that start with a single # are optional; remove the # to use them.

## ---------- Tosun AntiCheat: server.cfg block ----------
## OneSync is a manifest dependency (txAdmin can also enable it).
set onesync on

## Dependencies: start them before tosun-ac.
## oxmysql and tosun_render are hard dependencies.
## screenshot-basic is the default ts.screenshotModule.
## Configure mysql_connection_string before ensure oxmysql (see the MySQL guide).
ensure oxmysql
ensure screenshot-basic
ensure tosun_render

## Credentials: use set (never setr or sets) and keep them ABOVE ensure tosun-ac.
## They are read once when the resource loads.
## License format: tac_live_ followed by 40 lowercase hex characters.
set tosun_ac_license "YOUR_LICENSE_KEY"
## Optional: when empty, the panel key is loaded from panel_settings in the game DB.
# set tosun_ac_panel_key "YOUR_PANEL_API_KEY"
# set tosun_ac_central_token "YOUR_FIVEM_SCOPED_TOKEN"
## Optional: only used by ts.licenseLock.
# set tosun_ac_server_id "server-1"

## Resources that may call guarded AC exports (comma separated).
set tosun_ac_trusted_resources "my-housing,my-clothing"

## Optional: public https panel address for screenshot and evidence uploads.
# set ts_public_panel_url "https://panel.example.com"

## Optional: control the Tosun Connect DB bridge from this file.
## Without the manual line (and with ts.panelMirror off), both bridge convars are forced to "1".
# set tosun_db_bridge_manual "1"
# set tosun_db_bridge_enabled "1"
# set tosun_db_bridge_money_write "0"

## Optional: turn off the playtime writer (qb, qbcore and qbox only).
# set tosun_panel_playtime "0"

## Optional, for integrators who use the bridge files. Clients read these, so use setr.
# setr tosun_ac_resource "tosun-ac"
# setr tosun_ac_bridge_client_ms "60000"

ensure tosun-ac

## ---------- Staff permissions ----------
## Staff status and the in-game admin menu:
add_ace group.admin tosun.admin allow
## tosunac_setup, the manual scans and the ban-screen preview:
add_ace group.admin tosunac.admin allow
add_ace group.admin command.tosunac_setup allow
add_ace group.admin command.tosunac_backdoorscan allow
add_ace group.admin command.tosunac_eventscan allow
add_ace group.admin tosunac.banscreen.test allow
## One line per staff member:
add_principal identifier.license:YOUR_LICENSE_HEX group.admin

## ---------- FiveM hardening convars the AC checks at start ----------
set sv_stateBagStrictMode true
set sv_filterRequestControl 2
set sv_enableNetworkedSounds false
set sv_enableNetworkedPhoneExplosions false
set sv_enableNetworkedScriptEntityStates false
set sv_scriptHookAllowed false
## Test first: relaxed or strict can break scripts that spawn vehicles from the client.
set sv_entityLockdown relaxed
set sv_pureLevel 1
## The server.cfg audit warns while this is empty:
# set sv_enforceGameBuild YOUR_GAME_BUILD

• MySQL setup
• Setup guide

Rules for the server.cfg block#

Follow these rules when you adapt the example to your server.

• Start oxmysql and tosun_render before tosun-ac. The manifest declares server build 4890 or newer, OneSync, oxmysql and tosun_render as dependencies.
• Start screenshot-basic if you keep the default ts.screenshotModule.
• Put every set tosun_ac_ credential line before ensure tosun-ac. The values are read once at load; a later change needs a resource restart.
• Use set for credentials. setr replicates the value to every client, and sets publishes it in the public server info.
• Use setr only for convars that clients read: ts_screen_upload, tosun_ac_resource and tosun_ac_bridge_client_ms.
• You need no DB bridge line. Since 9.6.14 the bridge is on by default, and set ... "0" lines are ignored unless tosun_db_bridge_manual is "1" or ts.panelMirror.enabled = true.
• Older install guides (INSTALLER-READY.md, INSTALLER-LICENSE.md, INSTALL-MULTILANG.md, CONFIG-PERFORMANCE-GUIDE.md) put ensure before the credentials, put the panel key in configs/anticheat_config.lua and leave out tosun_render. Follow this page instead.

Convar reference#

Every convar Tosun AntiCheat reads that you may set. Use set unless the Notes column says setr. The AC also writes and reads a few internal convars of its own; they are protected and you must not set them.

Credentials: precedence and handling#

Three credentials are resolved once when the resource loads: the license key, the panel API key and the central token. For each one, the AC takes the first non-empty value in this order.

The MIGRATION warning asks you to clear the shared value and rotate any credential that was ever stored there, because that file is sent to every client.

A value longer than 4096 characters, or one that contains control characters, stops the load with an Invalid server credential setting error.

Panel key only: if it is still empty after these steps, the AC copies panel_settings.ac_api_key from the game DB. At every start the AC writes the resolved key into the ac_settings row webPanelKey, in plaintext. If someone edits that row in the panel, the edited value replaces yours until the next restart.

License key only: the license lock accepts tac_live_ plus 40 lowercase hex (49 characters), TOSUN-AC-YYYY-... and TOSUN-... formats. The format check runs only when ts.licenseLock.enabled = true, and it checks the format only.

1. The server convar: tosun_ac_license, tosun_ac_panel_key or tosun_ac_central_token.
2. The value in configs/anticheat_server.lua: licenseKey, panelKey or centralToken.
3. The legacy value in the shared configs/anticheat_config.lua: ts.licenseLock.licenseKey, ts.webPanelKey or ts.Central.token. Any value here prints a MIGRATION warning in the console.

• License key

configs/anticheat_server.lua#

Use this server-only file when you prefer not to put credentials in server.cfg. It loads before the AC's server scripts and returns immediately on clients. Leave a slot empty to keep using the convar or the database discovery.

• A non-empty convar always wins over the value in this file.
• Keep the matching slots in configs/anticheat_config.lua blank: ts.webPanelKey, ts.Central.token and ts.licenseLock.licenseKey.
• Keep backups of this file private.
• The file only fills ts.webPanelKey, ts.Central.token and ts.licenseLock.licenseKey. Other scripts read those values, not the file.

-- configs/anticheat_server.lua (server only)
local credentials = {
    panelKey = '',     -- or: set tosun_ac_panel_key "YOUR_PANEL_API_KEY"
    centralToken = '', -- or: set tosun_ac_central_token "YOUR_FIVEM_SCOPED_TOKEN"
    licenseKey = '',   -- or: set tosun_ac_license "YOUR_SERVER_LICENSE"
}

Panel URL and screenshot uploads#

ts.webPanelURL in configs/anticheat_config.lua is the panel base URL. You can leave it blank: when it is empty, the AC loads panel_url or site_url from panel_settings in the game DB and stores it in ac_settings. The HTTP settings sync runs only when both the URL and the panel key are set.

Set ts_public_panel_url only when screenshots, ban evidence and live video must go to a different public address. It must be https. Upload tokens are only issued for https://host/api/screen_upload.php when the base equals this convar or ts.webPanelURL.

ts_screen_upload is a separate path used by the screenCapture export and the /capture and /ts_capture commands. It needs setr, and its default points at localhost. Nothing in the AC handles the result of that upload.

The legacy names ts.PanelUrl, ts.panelUrl and ts.webPanelUrl are still read as fallbacks.

• Panel setup

Tosun Connect DB bridge convars#

Since 9.6.14 the on-demand DB bridge is on by default and needs no server.cfg line. At load, editable/server/tosun_db_bridge_defaults.lua sets tosun_db_bridge_enabled and tosun_db_bridge_money_write to "1", so the "0" lines from older guides are ignored.

You can also turn the connection off for one server in the panel: Servers, then the server, then the Tosun Connect card.

The bridge polls https://admin.tosundev.com/api/server_db_bridge.php, sends your license key as a Bearer token and runs only these ops: players.list, player.detail, player.vehicles, bans.list, logs.list and player.money.set.

With ts.panelMirror.enabled = true the AC does not force the bridge on, so the legacy mirror keeps working. The mirror itself does not run while tosun_db_bridge_enabled is "1".

The console commands tosunac_db_status and tosunac_db_check show the bridge state and test oxmysql.

1. To control the bridge from server.cfg, add set tosun_db_bridge_manual "1" before ensure tosun-ac.
2. Add set tosun_db_bridge_enabled with "1" or "0".
3. Add set tosun_db_bridge_money_write with "1" or "0". Without "1", player.money.set fails with write_disabled and is not advertised to the panel.

• MySQL setup

Convars for script developers#

These convars matter only when another resource calls the AC. tosun_ac_trusted_resources decides which resources may call guarded exports; the bridge convars configure the optional bridge files.

Guarded exports include SetExempt, SetPlayerExempt, the Pause exports, BypassDetection, addAdmin, whitelistPlayer, approveResource, ban, offlineBan, the webBridge exports and quarantine.

The server console and tosun-ac itself are always trusted. An untrusted call is rejected; for each resource and export pair the AC prints one console warning and one panel log line that names this convar. With ts.EnforceExportCallerWhitelist = false the call runs and is only logged once.

Trusted callers also get MarkTeleport without the per-player budget.

INTEGRATION.md and bridge/INTEGRATION.txt show set for tosun_ac_resource and tosun_ac_bridge_client_ms. Use setr instead: the client bridge reads both on the client.

Internal AC events and exports also exist. They are protected and must not be called from your resources.

# Resources allowed to call guarded exports (comma or space separated)
set tosun_ac_trusted_resources "my-housing,my-clothing"

# Bridge files inside your own resource
setr tosun_ac_resource "tosun-ac"
setr tosun_ac_bridge_client_ms "60000"
set tosun_ac_bridge_server_ms "60000"
set tosun_ac_bridge_cooldown_ms "750"

• Exports
• Export reference
• Events

ACE permissions#

Every ACE Tosun AntiCheat checks. Grant ACEs to a group and add staff to the group with add_principal. An ACE that builtin.everyone also has never makes anyone staff.

• Commands

Restricted and console-only commands#

Ten AC commands are registered as restricted. In game, FiveM then requires the matching command ACE on top of the AC's own check. Five of the ten ignore players completely.

banscreentest is not restricted. The console form banscreentest playerId needs no ACE; the in-game /banscreentest needs tosunac.banscreen.test or tosunac.admin. Denials of tosunac_setup, the two scans and banscreentest are silent.

tosunac_setup approves nothing if the backdoor or signature scan does not finish, including when ts.BackdoorGuard is disabled. A second run while one is in progress is refused.

• Commands

How staff is recognised#

The AC has two separate access levels. Staff status gives punishment exemption and the staff commands (/ts subcommands and the ts_ commands). Menu access opens the in-game admin menu. Some sources grant only one of them.

Punishment exemption for staff applies only while ts.AdminBypassDetections = true (shipped) and ts.Debug = false (shipped).

Menu access also needs ts.AdminMenu.enable and ts.AdminMenu.enabled to stay true. When either is false, the menu, the F7 key and the client admin-tool commands are not registered.

Staff who have staff status but no menu access, for example txAdmin-only staff, can still press F7. The request is denied and logged.

• Commands

Identifier lists: Admins, allowedIds and AdminBypassIdentifiers#

Use full identifiers such as license:, steam:, discord: or fivem: values. Prefer admins/anticheat_admins.lua or panel grants for staff: that file is server-only, while configs/anticheat_config.lua is sent to every client.

• Admins: an entry matches the full identifier (case-insensitive) or the part after the prefix. It grants staff status and the menu.
• ts.AdminMenu.allowedIds: staff status and the menu. The values "all" and "staff" grant nothing.
• ts.AdminBypassIdentifiers: staff status and exemption only, no menu.

-- admins/anticheat_admins.lua (server only)
Admins = {
    "license:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    "steam:11000010xxxxxxxx",
    "discord:123456789012345678",
}

-- configs/anticheat_config.lua (shared, sent to clients)
ts.AdminMenu = {
    -- other menu keys stay as shipped
    allowedIds = {
        "license:YOUR_EXACT_PLAYER_IDENTIFIER",
    },
}
ts.AdminBypassIdentifiers = {}  -- staff status and exemption, no menu

Panel grants and the addAdmin export#

Panel grants are rows in ac_v7_admin_grants that you create in the web panel. An active grant matches the player's license or license2, with or without the prefix, and gives staff status and menu access.

A positive answer is cached for 5 s and a negative one for 30 s, so a new grant can take up to 30 s to apply to a player who was already checked.

A trusted resource can call the addAdmin export to give a player staff status and menu access until removeAdmin is called. While ts.EnforceExportCallerWhitelist is true, the caller must be listed in tosun_ac_trusted_resources or ts.ExportCallerWhitelist.

• Panel setup
• Exports

Player whitelist is not staff#

The panel player whitelist (ac_whitelist) and identifiers added at runtime by the whitelist exports only stop punishments. They give no staff commands and no admin menu.

• A row counts while expires_at is empty or in the future.
• Accepted values: a license, discord, steam or fivem identifier, or a citizenid. Prefixes are stripped.
• Runtime entries are kept in memory and are lost on restart.
• Both lists are ignored while ts.Debug = true.

Settings that change staff handling#

These keys in configs/anticheat_config.lua change how staff and unauthorized menu users are treated.

builtin.everyone and the connect-time IP check#

Every staff and menu ACE check ignores an ACE that builtin.everyone also has. So add_ace builtin.everyone command allow does not make players staff. The connect-time IP check works differently.

While ts.v12.bypassStaffIpCheck is not false, a connecting player skips the country denylist and the VPN, proxy and hosting rejects in any of these cases: the player is staff; the player has the ACE command, txadmin, tx.admin, txadmin.menu, command.kick, command.ban or one of the group.admin, group.superadmin, group.moderator or group.god names; or an active panel grant matches the player's license exactly.

This check uses plain ACE tests with no builtin.everyone filter. On a server with add_ace builtin.everyone command allow, every player therefore skips the VPN and country checks. The join-flood check still runs before the bypass.

Discord webhooks file#

configs/anticheat_webhooks.lua is server-only. It holds one Discord webhook URL per log channel and the embed style. Every URL ships as the placeholder WEBHOOK_URL_BURAYA.

• The panel HTTP sync overwrites any webhook for which it sends a non-empty URL.
• Other resources receive the webhook URLs through getConfig('webhooks') only when they are trusted callers.
• Screenshot logs label the Detections embed with ts.punishType rather than the resolved punishment, and also post to Webhooks.Bans whenever ts.punishType is BAN.
• Webhooks.WebhookAvatar sets the embed avatar image.

Webhooks.Detections    = "https://discord.com/api/webhooks/..."
Webhooks.Bans          = "https://discord.com/api/webhooks/..."
Webhooks.AdminMenuLogs = "https://discord.com/api/webhooks/..."
Webhooks.Connections   = "https://discord.com/api/webhooks/..."
Webhooks.OCR           = "https://discord.com/api/webhooks/..."
Webhooks.Commands      = "https://discord.com/api/webhooks/..."
Webhooks.MoneyLogs     = "https://discord.com/api/webhooks/..."
Webhooks.ResourceLogs  = "https://discord.com/api/webhooks/..."

Webhooks.WebhookUsername = "Tosun AntiCheat"
Webhooks.WebhookColor    = 15285208
Webhooks.WebhookInlines  = true

How the panel overrides the config file#

Most values in configs/anticheat_config.lua are defaults. The web panel keeps its own values in ac_settings and other ac_ tables, and those values win. Edit the file only for values the panel does not manage.

• About 3 s after start, and then every ts.ServerPerf.configSyncIntervalSec seconds (shipped 120, minimum 20, fallback 60), ac_settings rows overwrite ts values.
• Dotted keys such as AdminMenu.enable write nested fields. Legacy flat keys such as framework or moneyCheck are mapped first.
• A punishment_ key writes ts.DetectionPunishments for that detection. BAN and KICK are kept; any other value becomes LOG.
• Action fields are normalized to ban, kick, log, cancel, reject or stop. Any other value becomes log.
• Keys that start with globalBan. are ignored.
• Panel lists replace config lists: weapons, vehicle blacklist, plates, trigger list, event limits, whitelisted resources, OCR words, the Blacklist lists, the explosion list and the entity whitelists. Whitelisted resources and OCR words from the database are merged instead.
• Exception: the ts.EventLimiter and ts.ProtectedEvents handlers are registered once from the file at load. Later panel changes do not change server-side enforcement for them.
• After a change, only client-safe keys are re-sent to clients.
• Run tosunac_doctor in the console to review risky values after the panel sync.

• Configuration and performance
• Panel setup

Core settings#

Top-level keys near the start of configs/anticheat_config.lua. Most of them can also be set from the panel.

Configuration sections: detections and punishments#

Sections that decide what is detected and how hard it is punished.

Configuration sections: server-side guards#

Guards that run on the server. Several of them cancel the event first and punish only after repeated strikes.

Configuration sections: connection, admin and panel#

Sections for joining players, the admin menu, the panel connection and server-wide behavior.

Configuration sections: resources, events and integration#

Sections for resource trust, scanners and the developer integration. Rows marked for developers matter only when your own scripts call the AC.

• Exports
• Events
• Framework

Configuration sections: lists#

Default lists in configs/anticheat_config.lua. Most of them are replaced by the panel tables on sync.

Keys that do nothing, and keys missing from the file#

Some keys in configs/anticheat_config.lua are not read by the code in 9.6.15. Changing them has no effect.

The code also reads keys that the file does not contain. Add them yourself if you need them: ts.v12.joinFloodWindowSec (60), ts.v12.joinFloodMaxJoins (6), ts.v12.bannedCountries (country codes; a geo denylist), ts.v6Enforcement.heuristic (replaces the list of heuristic types), ts.LiveWatch.fps (30), ts.SafeEventMaxArgs (64), and always = true on ts.DetectionExempt server events.

These client toggles are read but not in the file, and are on unless set to false: ts.antiScreenshotBypass, ts.antiRateOfFire and ts.antiNetOwnership. ts.microJitterMeanMin (0.5) is also read but not in the file.

• ts.NetworkJoin.minimalSync
• ts.AdminMenu.espMaxDistance and ts.AdminMenu.screenshotTimeout (the ESP uses espMaxDist)
• ts.AdminMenu.permissionLevel (a legacy label; access comes from ACEs, lists and grants)
• ts.ResourceGuard.strictClientDiff
• ts.LiveWatch.enabled, preferTosunRender and maxConcurrent
• ts.PhoneNotify.enabled, onBan and onDetect

Comments in the config file that are out of date#

A few comments inside configs/anticheat_config.lua describe older behavior. The code works as follows.

• The comment says panel settings re-sync every 30 s. The interval is ts.ServerPerf.configSyncIntervalSec (shipped 120 s).
• The comment says tosunac_setup whitelists events. It only catalogues them; ts.EventScanner.autoProtect decides protection.
• The ts.ProtectedEvents comment warns that framework events cause false bans. Unkeyed calls are rejected and logged, never punished.
• The ts.EventLimiter comment says it triggers when the limit is exceeded. It fires when the count reaches the value.
• The bridge comment recommends setr for all four bridge convars. Only tosun_ac_resource and tosun_ac_bridge_client_ms need setr.
• The ts.Locale comment omits ar, but locales/ar.json ships.

FiveM hardening convars the AC checks#

Two modules read FiveM convars at start. The convar guard (ts.hardening) runs about 8 s after start and treats an unset value as weak. The server.cfg audit (ts.cfgAudit) runs 15 s after start and is read-only.

Hardening switches and output#

Both checks only report by default. Change them in configs/anticheat_config.lua.

• ts.hardening.enabled = false skips the convar guard.
• ts.hardening.autoApply = true (shipped false) lets the AC run set itself for the six safe convars. sv_entityLockdown and sv_pureLevel are never applied automatically.
• ts.cfgAudit.enabled = false turns the server.cfg audit off.
• The convar guard prints a console warning and writes one ac_detections row (detection_type hardening_missing) that lists every weak convar.
• The audit prints a console warning and writes one admin_logs row with the number of weak settings.
• The console text of both checks is hard-coded Turkish. Each guard warning line shows the exact set line to add.
• tosunac_doctor is a separate console report about risky AC settings, not FiveM convars.

Common mistakes#

Check these before you open a support ticket.

• Credentials set with setr or sets: they reach every client or the public server info.
• Credentials placed after ensure tosun-ac: they are not picked up until the next resource restart.
• A panel key in configs/anticheat_config.lua: the file is sent to clients and the console prints a MIGRATION warning.
• tosun_render not started: it is a hard dependency.
• ts.Framework.framework left at "qb" on an ESX or Qbox server.
• ts.Locale left at "tr" on a server that does not use Turkish.
• ts.appealDiscord left on the vendor's Discord link.
• ts.punishType set to LOG or KICK: manual bans become logs or kicks too.
• add_ace builtin.everyone command allow: every player skips the VPN and country checks.
• Expecting tosun.admin to unlock tosunac_setup: that needs tosunac.admin plus command.tosunac_setup.
• Expecting txAdmin admins to open the AC menu: txAdmin ACEs give staff status only. Add tosun.admin or a panel grant.
• set tosun_db_bridge_enabled "0" without tosun_db_bridge_manual "1": the line is ignored.
• ts.Debug left at true: staff and whitelist bypasses are off.

• Start
• Commands