External allowlist for FiveM resources

Verified against txAdmin v8.1.2 allowlist schema and player join check; reviewed 1 November 2026.

What external mode doesCopy Anchor Link

The external allowlist option delegates allowlist decisions to your own FiveM resource. This mode does not automatically contact a website, check Discord roles, validate a webhook, or provide an authenticated REST API. txAdmin's ban checks can still apply when enabled. Do not disable ban protection to implement a separate allowlist.

Recommended architectureCopy Anchor Link

1. Keep your trusted permission/approval database server-side.
2. Implement a server-side playerConnecting handler in a dedicated resource, using Cfx's deferrals flow when an asynchronous approval lookup is required.
3. Identify the player using validated, server-observed identifiers. Do not treat the player's display name or client-provided approval as authorization.
4. Apply a short request timeout and a documented deny/error policy when the approval backend is unavailable.
5. Record minimal, redacted access decisions. Never log raw access tokens, registration keys or full player identifiers in public channels.
6. Test one allowed player, one denied player, and one simulated backend failure. Verify that an active txAdmin ban is still enforced.

A resource-controlled check is separate from txAdmin panel authentication and manage.admins permissions. Treat admin and game-entry access as distinct authorization boundaries.

Cfx deferrals contractCopy Anchor Link

For asynchronous verification, playerConnecting supplies a deferrals object. After deferrals.defer(), allow at least one tick before update or done. Once a preceding deferral method has run, allow another tick before done. Call done(reason) to reject or done() to accept. This guide deliberately does not copy an external API example with embedded keys: implement your own bounded, authenticated lookup and handle its failures explicitly.

What txAdmin events do not guaranteeCopy Anchor Link

The txAdmin:events:whitelist* events are notifications, not an always-on state synchronization API. Events may fire while a game server is offline, so your resource can miss them. For authoritative approval records, query your own durable source or use the supported txAdmin UI modes.

Related: Allowlisting & access, Discord allowlist troubleshooting, txAdmin events.

Sources: txAdmin v8.1.2 whitelist schema, txAdmin v8.1.2 player join code, Cfx playerConnecting documentation.