Admin Permissions

To become admin in ESX Legacy, set your ESX group to admin: run setgroup <yourServerId> admin in the server console, or set users.group to admin in the database while you are offline. ESX then links that group to FiveM's ACE system (group.admin), which is what actually unlocks the admin commands, so server.cfg also needs the ACE lines shown below.

OverviewCopy Anchor Link

ESX permissions have two layers that work together:

When a player loads, es_extended runs add_principal identifier.<license> group.<esxGroup>. When you change the group with /setgroup or xPlayer.setGroup(), it removes the old principal and adds the new one. Every command registered with ESX.RegisterCommand gets an add_ace group.<group> command.<name> allow entry for each allowed group.

The default groups are user, admin and owner. The column is free text, so you can invent more, but each group needs entries in Config.CommandPermissions to be useful. A group named superadmin is converted to admin when the player loads.

Required server.cfg linesCopy Anchor Link

These lines come with the official txAdmin recipe and server.cfg. If you set up the server by hand, check that they exist:

add_principal group.admin group.user
add_ace group.admin command allow       # allow all commands
add_ace group.admin command.quit deny   # but don't allow quit
add_ace resource.es_extended command.add_ace allow
add_ace resource.es_extended command.add_principal allow
add_ace resource.es_extended command.remove_principal allow
add_ace resource.es_extended command.stop allow

The resource.es_extended lines let es_extended run add_ace, add_principal and remove_principal itself. Without them, ESX groups never turn into ACE permissions and admin commands are denied even when the database says admin.

Make yourself adminCopy Anchor Link

setgroup 1 admin

Alternative: edit the databaseCopy Anchor Link

With the player offline, update the row directly. The identifier is the Rockstar license hash without the license: prefix; with esx_multicharacter it is prefixed with the character slot, for example char1:.

UPDATE `users` SET `group` = 'admin' WHERE `identifier` = 'char1:1a2b3c4d5e6f...';

Do this only while the player is offline. An online player's group lives in memory and is saved back on the next save, which would overwrite your change.

Alternative: admin on first join through ACECopy Anchor Link

When a new player row is created, es_extended checks IsPlayerAceAllowed(source, 'command'). If the player already has ACE access to command (for example through an add_principal identifier.license:... group.admin line in server.cfg), they are created with group admin. The txAdmin recipe adds such lines for the txAdmin master account ({{addPrincipalsMaster}}), which is why the server owner is often admin automatically. This only affects new characters; existing ones keep their stored group.

add_principal identifier.license:1a2b3c4d5e6f... group.admin

On a local test server with sv_lan set to true, every player counts as admin.

Config.CommandPermissionsCopy Anchor Link

In es_extended/shared/config/main.lua, Config.CommandPermissions maps each built-in command to the groups that may use it:

Config.CommandPermissions = {
    ["setjob"]    = { "owner", "admin" },
    ["car"]       = { "owner", "admin" },
    ["noclip"]    = { "owner", "admin" },
    ["job"]       = { "user", "admin", "owner" },
    -- ...
}

To let a mod group use /goto and /bring but nothing else:

["goto"]  = { "owner", "admin", "mod" },
["bring"] = { "owner", "admin", "mod" },

Then setgroup <id> mod. A command without an entry is restricted to admin with a console warning.

Config.AdminGroups (owner and admin) is marked deprecated in 1.16.4 but is still read by xPlayer.isAdmin(). Keep it in sync if third-party scripts rely on it.

Built-in admin commandsCopy Anchor Link

All of these accept me as the player ID in game. Most also work from the server console.

With Config.AdminLogging = true and a webhook configured in the logs config, many of these commands are logged to Discord. For a full menu, see esx_adminmenu. A full list of commands is on the Commands page.

Add your own admin-only commandCopy Anchor Link

ESX.RegisterCommand handles the ACE setup, argument parsing and the chat suggestion for you:

ESX = exports['es_extended']:getSharedObject()

ESX.RegisterCommand('announce', { 'owner', 'admin' }, function(xPlayer, args, showError)
    if #args.message < 3 then
        return showError('Message too short')
    end

    TriggerClientEvent('chat:addMessage', -1, {
        args = { 'Announcement', args.message },
    })
end, true, {
    help = 'Send a server-wide announcement',
    arguments = {
        { name = 'message', help = 'Text to send', type = 'merge' },
    },
})

To check permissions in your own events, read the group on the server, never trust the client:

RegisterNetEvent('myresource:adminAction', function()
    local xPlayer = ESX.GetPlayerFromId(source)
    if not xPlayer or xPlayer.getGroup() ~= 'admin' then
        return
    end
    -- privileged code
end)

Common issuesCopy Anchor Link

RelatedCopy Anchor Link

• Commands
• server.cfg
• xPlayer reference
• Main config
• esx_adminmenu

Frequently asked questions