Choose a ConVar’s audience before setting it

A ConVar is a configuration value, not an arbitrary server command. ensure, endpoint_add_tcp and refresh perform commands; adding set in front of an invented name does not make a platform feature exist.

The official ConVar contract  distinguishes three server-defined kinds.

Never use setr or sets for passwords, database connection strings, tokens or webhook secrets. A standard ConVar is not isolated from other server resources. Only install trusted server code, and apply sandbox read permissions when the platform supports the intended restriction.

Commands and quoting

set docs_mode "local test"
setr docs_theme "dark"
sets docs_region "Europe"

In the server console, typing the name of an existing ConVar prints its value and metadata. An unknown name may report No such command. Do not query secret values on a shared screen or in a recorded console session. Editing server.cfg does not necessarily change a running process until that configuration is executed or the server is restarted.

A resource invoking ExecuteCommand('set ...') needs the appropriate command.set ACE. Do not grant command wholesale to work around a narrow permission problem. Native setters provide a direct API; callers still need the appropriate runtime context and must respect applicable permission controls.

Typed reads and defaults

GetConvar(name, fallback) returns a string. GetConvarInt(name, fallback) reads an integer. The fallback handles an unset value; it is not a validation policy for every malformed string.

-- server.lua; deliberately validate external configuration.
local raw = GetConvar('docs_max_preview_items', '20')
local value = tonumber(raw)
local maxItems = 20
if value and value % 1 == 0 and value >= 1 and value <= 100 then
    maxItems = value
else
    print('Invalid docs_max_preview_items; using the safe default of 20.')
end

A client can read GetConvar('docs_theme', 'light') after the server replicates that value. It cannot use GetConvar to retrieve an ordinary server-only configuration. Never convert a security-sensitive setting into a replicated variable merely to make a client example work; send only the result the client needs.

Public server metadata

The 14 October 2026 Cfx announcement  moves FiveM and RedM public listing metadata to the Cfx Portal . Existing server.cfg listing values remain displayed during the transition until 21 October 2026. From that date, configure the public name, tagline, description, tags, language, banner and icon in the Portal.

The affected legacy settings are sv_hostname, sv_projectName, sv_projectDesc, tags, locale, banner_detail, banner_connecting and load_server_icon. Neither sets nor SetConvarServerInfo should be presented as a replacement for editing those Portal fields. Review backfilled information and missing fields using the migration checklist.

This change does not remove the general ConVar APIs or make a local GetConvar('sv_hostname', ...) read an authoritative Portal lookup. Preserve existing API response parsing unless its upstream schema changes; do not assume every local field is synchronized with the public listing. Resource-specific locales remain resource configuration.

sets sv_appearAllowlisted true only displays an allowlist indicator; it does not implement admission control. Pair it with actual connection deferrals.

sv_master1 "" disables joining through the browser interface but does not de-list the server under the current command contract. Do not use it as a firewall or privacy guarantee. See networking and listing.

FxDK configuration controls

The manifest’s convar_category presents selected settings in FxDK Project Settings. In that declaration, $name denotes a replicated variable and #name denotes public server information; an unprefixed name is standard. Those prefixes belong to the FxDK descriptor, not the actual GetConvar key.

A masked password field is a UI convenience, not encryption and not permission to publish the value. See the complete manifest entry reference for descriptor types, defaults, slider bounds and choices.

Diagnose before broadening access

Check the exact name and capitalization used by the resource, where configuration executes, whether the value is standard/replicated/public, and whether the code reads once at startup or on each operation. Inspect denial logs without exposing the actual secret. Do not scatter competing setters across several resources and then rely on startup timing.

For the complete platform settings and defaults use server configuration. For fine-grained permissions use ACE permissions, and for client settings use the F8 command reference.