What Is a FiveM Script?

What is FiveM scripting, and where should you begin?

In FiveM, functionality such as jobs, garages, banking systems, HUDs and inventory interfaces is packaged into resources. A single resource may contain game logic, UI files, shared configuration and database integration.

Lua typically handles gameplay and events, NUI renders HTML/CSS/JavaScript interfaces, and FXServer manages the server environment. OneSync coordinates networked entities and players. Sensitive decisions—payments, inventory ownership and privileges—must be validated on the server.

Lua programming in FiveM

Lua is a small, approachable scripting language. FiveM developers use functions, tables, events and native APIs to create gameplay. The modern Lua runtime is based on Lua 5.4; the legacy lua54 'yes' manifest flag has no longer been necessary since June 2025. FiveM can also execute JavaScript and C# resources.

Example 1: A client-side command

RegisterCommand('hello', function()
    print('Hello from FiveM Client!')
end, false)

Declare the file with client_script in your manifest. The command then runs on the client, and its output can be viewed in the F8 console.

Example 2: A server-side command

RegisterCommand('welcome', function(source)
    if source == 0 then
        print('This command is for players.')
        return
    end
    TriggerClientEvent('chat:addMessage', source, {
        args = {'SERVER', 'Welcome to our FiveM server!'}
    })
end, false)

The server handles the command and sends a chat message to the target player. This example requires the common chat resource; use your server's NUI or notification system if it is absent.

Useful references: FiveM Lua runtime ↗ and Lua 5.4 manual ↗.

Resource layout and fxmanifest.lua

A resource is normally a folder inside your server's resources directory. Its fxmanifest.lua file declares the scripts, client assets and dependencies to load. The older __resource.lua filename is legacy.

A typical resource directory

resources/
└── [local]/
    └── my_resource/
        ├── fxmanifest.lua
        ├── config.lua
        ├── client/
        │   └── main.lua
        ├── server/
        │   └── main.lua
        └── html/
            └── index.html

fx_version 'cerulean'
game 'gta5'

author 'Example Developer'
description 'My FiveM resource'
version '1.0.0'

shared_script 'config.lua'
client_script 'client/main.lua'
server_script 'server/main.lua'

Supported fx_version names

fx_version controls the resource manifest compatibility level. It is not the GTA game build, FXServer artifact number or Lua language version.

fx_version 'cerulean'
game 'gta5'

Do not change old resources blindly. First test their behavior against the current artifacts and manifest documentation: Resource Manifest ↗.

server_script vs server_scripts

The singular form declares one script; the plural form accepts a list. The same pattern applies to client_script(s) and shared_script(s). Repeating singular declarations is valid, but avoid registering the same file twice.

-- One file
server_script 'server/main.lua'

-- Multiple files (recommended style)
server_scripts {
    'server/database.lua',
    'server/main.lua',
    'server/commands.lua'
}

-- You can also repeat singular directives
client_script 'client/main.lua'
client_script 'client/hud.lua'

-- Shared by server and client
shared_scripts {
    'shared/config.lua',
    'shared/constants.lua'
}

Wildcards and module folders

*.lua matches a directory level, while **/*.lua can match nested modules. Explicit ordering is preferable where one file must initialize dependencies before another.

client_scripts {
    'client/main.lua',
    'client/modules/*.lua'
}

server_scripts {
    'server/main.lua',
    'server/modules/**/*.lua'
}

Frequently used manifest directives

fx_version 'cerulean'
game 'gta5'

shared_scripts { 'config.lua' }
client_scripts { 'client/main.lua' }
server_scripts { 'server/main.lua' }

-- Resource dependencies
dependencies {
    'ox_lib',
    '/onesync'
}

-- Needed when using a local NUI page
ui_page 'html/index.html'
files {
    'html/index.html',
    'html/style.css',
    'html/app.js'
}

Declare only files and dependencies the resource really uses. Asset Escrow and runtime options may have their own platform requirements.

Server artifacts, FXServer and txAdmin

An artifact is a distributed build of the FXServer executable. It is different from a GTA game build, which determines compatible game content, and from fx_version, which controls resource manifest behavior.

1. Download the compatible server artifact from the official build listing.
2. Extract the files and run FXServer using the supported setup flow.
3. Use txAdmin for the setup wizard, resources, logs, restarts and administration.
4. Keep server.cfg under version-controlled operational review, without exposing secrets.

# Typical lines in server.cfg
set onesync on

ensure chat
ensure spawnmanager
ensure my_resource

Not every resource exists on every server, so ensure chat and other resource names are examples rather than mandatory lines.

Windows server artifacts ↗ txAdmin setup ↗

What is NUI? Building interfaces with HTML and CSS

NUI (New User Interface) is FiveM's Chromium-based user interface environment. You can build phones, banking apps, inventory panels, menus and interactive dashboards with familiar web technologies while game logic remains in Lua or another supported runtime.

The bridge from the client to the page is SendNUIMessage; to return data from JavaScript, send a POST request to an endpoint registered with RegisterNUICallback. SetNuiFocus controls keyboard/mouse focus. NUI should not be entrusted with secrets or authoritative game-state decisions.

Complete minimal NUI resource

demo_nui/
├── fxmanifest.lua
├── client.lua
└── html/
    └── index.html

fx_version 'cerulean'
game 'gta5'

ui_page 'html/index.html'
files { 'html/index.html' }
client_script 'client.lua'

local opened = false

local function setOpen(state)
    opened = state
    SetNuiFocus(state, state)
    SendNUIMessage({
        action = state and 'open' or 'close',
        text = 'Welcome to my FiveM NUI!'
    })
end

RegisterCommand('panel', function()
    setOpen(not opened)
end, false)

RegisterNUICallback('close', function(_, cb)
    setOpen(false)
    cb({ ok = true })
end)

RegisterNUICallback('ping', function(_, cb)
    cb({ ok = true, message = 'Pong from Lua!' })
end)

AddEventHandler('onClientResourceStop', function(name)
    if name == GetCurrentResourceName() then
        SetNuiFocus(false, false)
    end
end)

<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
<meta charset="UTF-8">
<title>FiveM NUI</title>
<style>
  body { margin: 0; background: transparent;
    font-family: Tahoma, sans-serif; }
  #panel { display: none; width: 360px;
    margin: 12vh auto; padding: 25px;
    background: #15263d; color: white;
    border-radius: 16px; }
  button { padding: 10px; cursor: pointer; }
</style>
</head>
<body>
  <div id="panel">
    <h2>FiveM Panel</h2>
    <p id="text"></p>
    <button id="ping">Test connection</button>
    <button id="close">Close</button>
  </div>
<script>
  const panel = document.getElementById('panel');
  const text = document.getElementById('text');

  window.addEventListener('message', event => {
    const data = event.data;
    if (data.action === 'open') {
      panel.style.display = 'block';
      text.textContent = data.text;
    }
    if (data.action === 'close') {
      panel.style.display = 'none';
    }
  });

  async function send(eventName) {
    const resource = GetParentResourceName();
    const result = await fetch(
      `https://${resource}/${eventName}`,
      { method: 'POST',
        headers: {'Content-Type': 'application/json'},
        body: JSON.stringify({}) }
    );
    return result.json();
  }

  document.getElementById('ping').onclick = async () => {
    const result = await send('ping');
    text.textContent = result.message;
  };
  document.getElementById('close').onclick = () => send('close');
</script>
</body>
</html>

JavaScript typically calls fetch(`https://${GetParentResourceName()}/close`, ...) to invoke a registered callback; this requires the correct resource name and HTTPS-based NUI callbacks for cerulean. Close the UI on resource stop to prevent a stuck cursor.

NUI documentation ↗ NUI callbacks ↗

Developer Mode and debugging tools

Opening the F8 console is not the same as enabling Developer Mode. F8 displays client logs and permits available console commands; development mode enables additional capabilities and depends on the FiveM client generation and server configuration.

# Put this in a DEVELOPMENT server.cfg only
set sv_devMode true

# Do not use in a production server

Documentation states that sv_devMode limits a development server to eight connected clients. Do not enable it casually on a production roleplay server.

Useful F8 and profiling commands

cmdlist
resmon true
nui_devTools
profiler record 500
profiler status
profiler view

resmon helps investigate resource performance and nui_devTools opens the Chromium inspector. Some NUI debugging flows also expose http://localhost:13172/. Availability can vary by client version or permissions.

Console commands ↗ Server commands ↗

OneSync and key server.cfg settings

OneSync provides networked entity and player synchronization. Its state-aware server behavior allows FXServer to decide which entities are relevant to which clients rather than forcing every client to simulate everything.

OneSync modes

# Current OneSync mode
set onesync on

# Keep ambient NPC and traffic spawning
set onesync_population true

What does set onesync_population false do?

It disables OneSync's default ambient population management. Leave it enabled if you want regular traffic and pedestrians, unless you intentionally operate a custom population system.

set onesync on
set onesync_population false

What about set svgui_disable 1?

This line appears in some older configurations related to the legacy FXServer graphical interface. The documented command is svgui; svgui_disable is not part of the currently published standard ConVar list. It is safer to remove unnecessary legacy settings than rely on an unverified effect.

# Legacy configurations may contain:
set svgui_disable 1

# Official documented GUI command:
svgui

Additional controls such as entity lockdown or ownership migration require separate testing. OneSync guide ↗ Server commands ↗

sv_enforceGameBuild: GTA versions and DLC

sv_enforceGameBuild selects the GTA V game build required for connecting clients and the related supported game content. It is unrelated to the FXServer artifact number and the manifest's fx_version. Higher builds generally contain additional game content, but you must check resource and IPL compatibility.

# Select game content for connecting clients
set sv_enforceGameBuild 3751

# Or, for a tested newer build:
# set sv_enforceGameBuild 3889

Documented FiveM game builds

This table reflects the published documentation reviewed on October 15, 2026; it is not a live registry of future game builds. For newer supported builds, open the official Server Commands page ↗ and locate sv_enforceGameBuild under the FiveM builds subsection.

Native Reference: finding and using game functions

Natives are APIs exposed by GTA V and the Cfx runtime. They let resources read coordinates, create vehicles, control cameras, manipulate entities and request map IPLs. Always check the API Set of the specific native: client-only and server-only functions are not interchangeable.

Inspect parameters, return values and notes. Some server calls are implemented through RPC and may not guarantee exactly the same result in every networking situation. Native Reference ↗

Spawning vehicles on the server and surviving disconnects

You can create vehicles using CreateVehicleServerSetter on FXServer. This is useful for fixed service vehicles, managed fleets and other entities that should not disappear simply because a particular player disconnects.

Example: A permission-limited admin command

RegisterCommand('svcar', function(source)
    if source <= 0 then
        print('Use /svcar in game as an authorized admin.')
        return
    end

    local ped = GetPlayerPed(source)
    if ped == 0 then return end

    local coords = GetEntityCoords(ped)
    local heading = GetEntityHeading(ped)

    local vehicle = CreateVehicleServerSetter(
        GetHashKey('sultan'),
        'automobile',
        coords.x + 3.0, coords.y, coords.z,
        heading
    )

    if vehicle == 0 then
        print('Failed to create server vehicle')
        return
    end

    SetEntityOrphanMode(vehicle, 2) -- KeepEntity
    print(('Created vehicle entity %s'):format(vehicle))
end, true) -- restrict by ACE permission

The last argument to RegisterCommand is true, requesting ACE permission enforcement. Grant the command only to authorized administrators in your actual permission setup.

add_ace group.admin command.svcar allow

With SetEntityOrphanMode(vehicle, 2), the value 2 requests KeepEntity: the server should not remove it merely because it becomes orphaned. Other scripts or explicit deletion requests can still remove it.

Disconnect vs resource restart vs FXServer restart

OneSync reference ↗ Natives ↗

IPL, YMAP, MLO and missing GTA interiors

IPL is part of GTA V's world-streaming system. Certain locations and interior states load only during particular missions or scenarios. A FiveM resource can request relevant IPLs on the client through RequestIpl; a different IPL can be removed with RemoveIpl when needed.

Client-side IPL loading example

fx_version 'cerulean'
game 'gta5'
client_script 'client.lua'

local requiredIpls = {
    'CS3_07_MPGates'
}

CreateThread(function()
    for _, name in ipairs(requiredIpls) do
        RequestIpl(name)
    end
end)

The IPL string is an example; verify its effect against your target game build. The script runs for connected clients when its resource is started. A server-side ensure command starts the resource, but the IPL request itself still belongs in client code.

What does bob74_ipl do?

bob74_ipl is a familiar community resource that requests many GTA V IPLs and optional interior/map states. Install it as a resource, review its configuration for your build and add it to server.cfg.

# In server.cfg
ensure bob74_ipl

When combined with third-party MLO resources or replacement maps, overlapping IPLs can produce invisible walls, conflicting doors or incomplete interiors. Disable only the conflicting loader or IPL; do not indiscriminately remove unrelated map content.

Original bob74_ipl repository ↗ Native Reference ↗

FiveM frameworks: ESX, QBCore, Qbox and others

A framework supplies reusable core systems and APIs for players, identity, character state, jobs, economy and communication between resources. Choosing one can accelerate roleplay development but does not guarantee quality by itself.

Libraries such as ox_lib, oxmysql and ox_inventory are not proof that a server uses the ox_core framework. They may run beside ESX, QBCore or a custom core.

FiveM framework documentation ↗

Standalone vs Customized: What is an independent server base?

“Standalone base” commonly describes a server where the development team writes its own central systems rather than depending on ESX, QBCore or another established RP framework. However, an individual standalone script simply means that the script is independently usable; it does not prove that the entire server has a bespoke core.

How can you tell what the server really uses?

Some Iranian FiveM servers use “custom base” to describe a substantially modified ESX package. Renaming folders or replacing interface graphics does not, by itself, create a new framework.

Read the resource manifests, export calls, framework references and schema before presenting a server as genuinely standalone.

Open source, source-available and asset escrow

The citizenfx/fivem repository is public, but its main licensing terms refer to the Rockstar Games Creator Platform License Agreement; designated components have LGPL v2 terms. A publicly viewable repository alone does not mean unrestricted redistribution or commercial rights.

Popular frameworks may have separate license conditions for different components. Commercial resources can use FiveM Asset Escrow to withhold portions of their source from buyers. Always inspect the actual license and the author’s distribution terms.

FiveM license ↗ FiveM repository ↗

Checklist for a production-ready resource

1. Declare fx_version 'cerulean' and game 'gta5' for a new GTA V resource.
2. Separate client, server and shared files; never trust client-supplied authority.
3. Use HTTPS-based NUI callbacks and release focus when the UI is closed.
4. Restrict admin commands through ACE or another server-side authorization system.
5. Test OneSync scoping, ownership migration and vehicle deletion behavior.
6. Persist important state in a real database and restore it after a server restart.
7. Check IPL conflicts, game-build compatibility and resource dependencies.
8. Document configuration, privacy, licenses and upgrade steps.

These principles apply equally to a customized ESX server or a completely original standalone framework.

ESX in early Iranian servers and the VMP distinction

Persian-language roleplay history includes community recollections of Iran Role Play, IRPixel and Sunrise RP, with customized ESX an important early server-development approach. Before porting older resources, audit dependencies such as es_extended, resource versions, server events and the data model. The label “custom” does not automatically mean framework-independent.

Following access problems affecting Iranian users of some FiveM and Cfx.re services, VMP and its server directory gained attention as an Iranian-focused GTA V multiplayer platform. Do not assume FiveM resources will run on VMP unchanged; verify platform versions and APIs first. For the historical context, read What Is FiveM?.

Official technical references

Use the current docs before changing a production server. Game builds, developer-mode behavior and certain compatibility flags may differ between FiveM Legacy and Enhanced.

Technical review: October 15, 2026. Confirm live ConVar and build availability against official Cfx.re documentation.