Asset escrow protects selected resource files

Asset Escrow restricts direct reading/modification of supported resource files and checks whether a server has the required entitlement. It is not a substitute for secure server events, authorization or safe configuration. Never assume protected client code makes client-supplied values trustworthy.

The pinned official escrow manual  lists Lua, YFT, YDD and YDR as supported formats. It does not list JavaScript or C# protection and says NUI is unsupported. Do not advertise a whole NUI application as encrypted because some accompanying Lua is protected. Track-specific Enhanced support must be checked separately in the migration reference.

Prepare and create an asset

Keep a private, versioned copy of all source files and build outputs. Remove credentials, private logs and test data from the resource archive. Leave the configuration and extension points that customers must edit outside escrow using escrow_ignore in fxmanifest.lua:

escrow_ignore {
    'config.lua',
    'locales/*.lua',
    'stream/editable_preview.ydr'
}

The patterns select files not to encrypt; they do not exclude them from downloads. Normal files, client/shared-script and streaming declarations still determine what a client receives. Review the manifest reference.

In the Cfx Portal , select Create an asset, name it and upload the ZIP through Select File. Wait for processing before downloading the protected artifact. The source’s upload limit is 1GB. Test a processed download, not merely the pre-upload development folder.

Update, download and delete

Under Created Assets, open the asset and use Re-Upload for a new ZIP. Processing replaces the current version in the creator’s account; the portal does not retain the old version as your backup. Existing customers who already downloaded an older release can continue using that copy, subject to entitlement. Therefore keep your own versioned rollback files and document configuration migrations.

The asset’s save/download control retrieves the processed package for use on servers the entitled account owns. Do not remove required protected metadata or rename files casually while troubleshooting. Delete removes the created asset after confirmation; export your own source/records first and assess customer impact before using it. No portal mutation is performed by this documentation task.

Distribution and subscriptions

The manual describes distribution through a Tebex package: choose FiveM Asset as the fulfillment type and select the desired asset. Buyers receive a download-link email. A subscription asset loses entitlement when the subscription expires and will no longer start on that user’s server. Plan customer communication and operational fallback rather than assuming an installed copy is a perpetual license.

The source says created assets cannot be transferred to another creator account and must be distributed through a Tebex package. This is a created-asset ownership rule; do not infer unrelated entitlement-transfer behavior without checking the portal’s actual supported workflow. See store setup for account linking and review requirements.

Additional obfuscation is not required by the documented escrow workflow. Do not claim that escrow makes exploitation impossible or promise an unverified encryption/decryption architecture. Protect server decisions through secure events regardless of delivery format.

Diagnose entitlement failures

An unauthorized server reports You lack the required entitlement and the resource will not start. Check the account that owns the server registration key, the account entitled to the asset, purchase/subscription state, processed download integrity, declared dependencies and the required track/artifact. Preserve logs but redact license keys and tokens.

A syntax error, unsupported binary, missing dependency or an Enhanced incompatibility is not necessarily an entitlement failure. Reproduce the exact error on a clean staging installation and contact the asset creator through the supported channel. Do not bypass entitlement checks, distribute modified protected files or download purported decryptors.

Acceptance checklist

Test an entitled staging server, editable configuration, a resource restart, a version update and rollback, and documented subscription behavior in an authorized test setup. Browser tests for this website do not establish those engine/portal results. Record the processed package version and the exact client/server track when reporting compatibility.