FiveM Ace Permissions: Identifiers Explained (steam:, license:, xbl:)

FiveM uses Access Control Entries (ACE) to grant staff permissions, admin commands, and resource privileges in server.cfg. The system identifies players through unique account namespaces such as steam:, license:, discord:, and xbl:.

Understanding how each identifier functions prevents permission leaks and ensures server security. Here is an explanation of every FiveM identifier type and how to configure them in your server files.

What Are FiveM Identifiers in the ACE System? #

A FiveM player identifier is a string that binds a specific gaming account or network protocol to an active player slot. When a user connects to an FXServer instance, the client sends all available identifiers to the server.

The server matches these incoming tags against permission rules defined in server.cfg. If an incoming identifier matches an entry in your admin group, the server grants the associated commands to that client.

As explained in our Steam Hex guide for FiveM & GTA RP, each platform uses a distinct namespace prefix separated by a colon.

All FiveM Identifier Types Explained #

FXServer recognizes seven distinct identifier namespaces:

1. `license:` and `license2:` (Rockstar Social Club) #

The license: tag represents the player's ownership of Grand Theft Auto V via Rockstar Games. Because you cannot launch FiveM without a valid GTA V installation, every player possesses a license identifier. Cfx.re recommends license: as the primary key for staff permissions because players cannot join without it.

2. `steam:` (Steam Hex) #

The steam: identifier is the hexadecimal representation of the player's 64-bit Steam ID. Most legacy frameworks, including older versions of ESX and QBCore, use steam: as the primary foreign key in MySQL tables. To find or convert any user's hex string, use our free SteamID Converter.

3. `discord:` (Discord Snowflake) #

Discord identifiers allow FiveM scripts to check if a player belongs to a specific Discord server. Community management resources (such as Badger_Discord_API or discord-roles) use this identifier to grant in-game whitelist access based on Discord server membership.

How to Configure ACE Permissions in `server.cfg` #

ACE permissions use two primary configuration commands: add_principal and add_ace.

• add_principal assigns an identifier to an administrative group (for example, group.admin or group.moderator).
• add_ace grants or denies permission nodes to that group.

Here is a tested configuration snippet from a production server.cfg:

# ===================================================
# FiveM ACE Permissions Configuration (server.cfg)
# ===================================================

# 1. Map Player Identifiers to Groups
# Method A: Assigning via Rockstar License (Recommended for security)
add_principal identifier.license:1234567890abcdef1234567890abcdef12345678 group.admin

# Method B: Assigning via Steam Hex ID
add_principal identifier.steam:1100001000056ba group.admin

# Method C: Assigning via Discord Snowflake ID
add_principal identifier.discord:198273645123456789 group.moderator

# 2. Define Group Hierarchy (Inheritance)
# Group admin inherits all permissions from group moderator
add_principal group.admin group.moderator

# 3. Grant Permission Nodes to Groups
# Allow moderators to use kick and ban commands
add_ace group.moderator command.kick allow
add_ace group.moderator command.ban allow

# Allow admins to execute all server commands
add_ace group.admin command allow

# Deny server shutdown via in-game chat console
add_ace group.admin command.quit deny

Why Use `license:` Instead of `steam:` for Server Security? #

Cfx.re advises server owners to bind high-level admin commands to license: rather than steam: for two reasons:

1. Player client flexibility: If a server does not strictly enforce Steam in its config, a staff member might launch FiveM while Steam is closed. If their admin role is bound solely to steam:, they lose their admin commands during that session.
2. Account ownership consistency: A player can switch Steam accounts on the same Windows user profile more easily than they can swap Rockstar Social Club licenses.

However, if your server utilizes MySQL roleplay databases (such as oxmysql), maintaining the steam: identifier is essential for character data tables. For database whitelist instructions, review our guide on how to whitelist a player by Steam Hex in FiveM.

Common Mistakes When Writing ACE Permissions #

Avoid these frequent mistakes in your server.cfg:

• Forgetting identifier. in the principal line: Writing add_principal steam:1100001... group.admin will fail silently. You must include the word identifier. before the namespace (identifier.steam:).
• Incorrect permission inheritance order: In FXServer ACE rules, add_principal group.admin group.moderator means admin inherits from moderator. Reversing this statement gives moderators full admin privileges.
• Spaces inside identifier values: Never place spaces around colons or values (identifier.steam: 1100001... is invalid).
• Using uppercase letters in Hex IDs: Always enter lowercase hexadecimal strings to ensure compatibility across all server scripts.

Frequently Asked Questions #

What is the difference between steam: and license: identifiers in FiveM? #

The steam: identifier is derived from your SteamID64 and requires the Steam client to be running. The license: identifier is tied to your Rockstar Social Club copy of GTA V and is always present whenever you connect to FiveM.

How do I find a player's FiveM identifiers while they are connected? #

Type status in your server console, or open the txAdmin Live Console / Players tab. FiveM lists all active identifiers including license, steam, discord, and IP.

Can players spoof their steam: identifier in FiveM? #

No. FXServer authenticates Steam tickets with the Valve Steam Web API during client connection handshakes. A player cannot fake their Steam Hex ID.

Which identifier is best for FiveM server admin permissions? #

Cfx.re recommends license: or license2: for administrative ACE permissions because Rockstar licenses cannot be detached from the game installation, whereas Steam accounts can be toggled.

Need to convert an applicant's Steam account into their valid Steam Hex identifier for server.cfg? Use our free SteamID Resolver to look up any profile format instantly.

Last updated: October 2026