Files & Convars

There are two config files and they are not interchangeable.

Both files stay open after asset escrow (together with locales/*.lua and bridge/*.lua), so you can edit them and keep your edits across updates.

#Units used in config.lua

#General

#Convars

Every secret in config_server.lua can also be set from server.cfg. The convar always wins over the value written in the file, and an empty or unset convar leaves the file value alone.

set recognition_secret            "a-long-random-string"
set recognition_webhook_default   "https://discord.com/api/webhooks/..."
set recognition_webhook_proofs    "https://discord.com/api/webhooks/..."
set recognition_webhook_deaths    "https://discord.com/api/webhooks/..."
set recognition_webhook_admin     "https://discord.com/api/webhooks/..."
set recognition_webhook_exports   "https://discord.com/api/webhooks/..."
set recognition_webhook_errors    "https://discord.com/api/webhooks/..."
set recognition_webhook_anomalies "https://discord.com/api/webhooks/..."
set recognition_fivemanage_key    "YOUR_KEY_HERE"
set recognition_photo_webhook     "https://discord.com/api/webhooks/..."

#The secret salt

ServerConfig.SecretSalt = ''       -- convar: recognition_secret
ServerConfig.AllowSaltChange = false

Leave it empty and the script generates one into the database on first start. That works, but it is weaker — anyone with database access can read it — and the console warns at every boot:

[5code-recognition] The secret salt is stored in the database. Set recognition_secret in server.cfg (see docs: Security).

#Anti-spam and safety limits

config_server.lua also holds a few protection blocks. Leave them as they are unless 5CODE support asks you to change them. Players never download this file.

#Letting other resources call our write exports

ServerConfig.Api = {
    TrustedResources = {},   -- e.g. { 'my_surgeon_shop', 'my_idcard' }
}

Our own bridges are always allowed. Anything else that calls a write export — ResetIdentity, StartFaceImplant, ReportDown / ReportRevived / ReportRespawned, GrantLabIdentification, LogAction, RecordIntroduction, GiveItem, TriggerItemUse — must be named here, or the call is refused and logged for admins.

#Performance logging

#What can and cannot be changed in game

Admins with the settings level can change almost everything in config.lua from the panel. These can only ever be changed in the files:

• Everything in ServerConfig — webhooks, the salt, photo keys, rate limits, retention. It is never even offered in the panel.
• Every integration selector (Config.Framework, Config.MulticharSystem, every *System key) and Config.MDT[...] — they are resolved once at boot.
• The admin permission settings (Config.Admin.Ace, .FrameworkGroups, .TxAdmin, .TxAdminPerms, .Perms, .GroupPerms, .LiveSettings, .FileOnly, .SettingPerms) and the audit switches (.BlockSelfEdit, .BlockSelfView, .RequireReason, .LogViews, .DiscordActions) — admins can never widen their own rights from inside the game.
• Config.Memory.Disguises, which changes the shape of stored memory rows.

Details, plus how to lock more keys yourself: Admin & Permissions.