FiveM ACE Permissions Generator
Build the add_ace and add_principal lines your FiveM server.cfg needs: group inheritance, player identifiers, command grants and custom ace objects. This is the access-control config that txAdmin does not fully auto-generate. Everything runs in your browser, with no login.
Principals: inheritance & membership
Each row adds a child principal to a parent, so the child inherits everything the parent can do. Use it to put a player identifier into a group, or to make one group inherit another.
Aces: grants
Each row allows or denies an object for a principal. The object can be command (all commands), a specific command.<name>, or a custom ace a resource checks with IsPlayerAceAllowed.
# ACE permissions: add to server.cfg
Grants (add_ace) are written first, then membership (add_principal). Rows with an empty required field are skipped automatically.
How FiveM ACE permissions work
Principalsare the "who". A principal is either a player identifier or a group. Identifiers use the form identifier.<type>:<id>, for example identifier.steam:110000112345678, identifier.license:abc123 or identifier.fivem:1234567. Groups are names you choose, conventionally group.admin, group.mod and so on.
Objects are the "what". Use command to cover every server command, or command.<name> (such as command.kick) to target a single command. You can also invent your own custom ace object, any string a resource checks with IsPlayerAceAllowed, e.g. car or menu.access.
allow / deny is the decision. Granting command allow to a group hands it every command, so keep that for trusted admins. Add a deny row to carve out exceptions, e.g. add_ace group.admin command.quit deny.
Tip: build one group.admin, make it inherit group.modwith a principal row, then add each staff member's identifier to the right group. You only manage groups after that.
FiveM ACE permissions, explained
What are FiveM ACE permissions?+
ACE stands for Access Control Entries, the permission system FiveM (and RedM) builds into server.cfg. Instead of hard-coding who can run what, you grant an "object" (like the command object, a specific command.<name>, or a custom ace a script checks) to a "principal" (a player identifier or a group such as group.admin) with either allow or deny. Resources then check permissions at runtime with IsPlayerAceAllowed, so your access control lives in one place in your config.
How do I make someone an admin in FiveM?+
Add the player's identifier to an admin group and give that group the permissions it needs. For example: add_principal identifier.steam:110000112345678 group.admin makes that player a member of group.admin, and add_ace group.admin command allow lets group.admin run every server command. You can find a player's identifier from txAdmin, server console, or a script that prints GetPlayerIdentifiers.
What's the difference between add_ace and add_principal?+
add_principal defines membership and inheritance: it says one principal belongs to (inherits the permissions of) another, e.g. add_principal group.admin group.mod means admins also get everything mods have, and add_principal identifier.license:abc123 group.admin adds a specific player to the admin group. add_ace defines a grant. It says a principal is allowed or denied a specific object, e.g. add_ace group.admin command allow. In short: add_principal decides who is in a group, add_ace decides what that group can do.
Does txAdmin do this for me?+
Partly. txAdmin manages its own admin list and web-panel permissions separately from server.cfg, so txAdmin admins do not automatically appear as ACE principals in your config. You still write add_ace and add_principal lines yourself for in-game command access, custom resource permissions, and any script that calls IsPlayerAceAllowed. This generator produces exactly those server.cfg lines, which sit alongside (not inside) txAdmin.
Related tools
All tools →More in FiveM & RedM Tools.