How to Install a FiveM Script

From the Tebex checkout to the Cfx.re Portal

A paid FiveM script is not delivered the way people expect. When the resource is protected by asset escrow, the Cfx.re documentation is clear that escrowed assets can only be distributed via a Tebex package, and what the sale actually does is attach a grant to the Cfx.re account used at checkout. There is no zip in the confirmation email for those. The files live on Cfx.re infrastructure and you go and get them.

The address for that changed recently, which is why half the tutorials online still send you to the wrong place. Keymaster used to host both server keys and the Assets and Grants pages. Cfx.re announced the deprecation of the Assets and Grants pages in Keymaster on 15 October 2025, and moved them to the Cfx.re Portal. So the current path is: log into portal.cfx.re with the Cfx.re account you used on the store, open Granted Assets, find the resource, download the most recent version. Our own product documentation starts every install with exactly that step for the same reason.

One thing to get right before you download anything: the Cfx.re account that bought the script and the Cfx.re account that generates your server license key have to be the same one. That is the single most common reason an escrowed resource refuses to boot, and it is not fixable from the server side. If you have not created the server yet, the guide on making a FiveM server covers the key generation and the first server.cfg.

Escrow asset or plain folder: what actually differs

You will install two kinds of resource on your server and they behave differently in one place only. An escrowed resource has been encrypted by Cfx.re before you ever saw it, and the documentation lists the supported formats as Lua, YFT, YDD and YDR, with a maximum asset size of 1 GB and no support for NUI. When it starts, the server license key is checked against the account that owns the asset. If the check fails, the docs say the resource will not start and an error stating You lack the required entitlement will appear in the server console.

A plain folder, meaning an open source or partially open build, has no such check. It runs on any server, including a test server on your own machine, and every Lua file is readable. Developers can also punch holes in escrow with the escrow_ignore directive in fxmanifest.lua, which is why config and locale files usually stay editable even inside a protected resource. What that means for you is covered in depth in escrow vs open source. For installation purposes the takeaway is short: same folder, same ensure line, same dependencies. Only the license check is extra.

Where the resource folder actually goes

The Cfx.re scripting manual gives the rule in one sentence: resources are loaded from a folder called resources/ in the server data directory, and any folder in the resources folder is parsed as a resource, except folders between brackets, which are categories. That is the whole system. A bracketed folder is a bin, not a resource, so it never gets started itself and it never appears in an error message.

server-data/
├─ server.cfg
└─ resources/
   ├─ [cfx-default]/          # shipped with cfx-server-data
   ├─ [standalone]/
   │  ├─ ox_lib/
   │  └─ oxmysql/
   ├─ [core]/
   │  └─ es_extended/
   └─ [var]/                  # your bracketed category, any name you like
      └─ Var-Bank/
         ├─ fxmanifest.lua    # this file is what makes it a resource
         ├─ config.lua
         ├─ sql/
         ├─ client/
         └─ server/

Two traps live in that tree. The first is the double folder: a zip named Var-Bank-2.1.0.zip often unpacks into a folder of that name containing the real Var-Bank folder, and the server sees a category-less folder with no fxmanifest.lua at the top. Open the folder and confirm that fxmanifest.lua is directly inside it before you go further. The second is renaming. The folder name is the resource name, it is what you write after ensure, and plenty of scripts reference their own resource name in exports and in framework registrations. Keep the name the documentation gives you.

Streaming assets follow the same rule but with a subfolder convention rather than a category: a stream/ folder inside the resource is picked up automatically. That is the mechanism behind add-on cars and MLOs, detailed in the guide on adding cars to FiveM.

server.cfg, ensure, and why order decides everything

server.cfg is read top to bottom, once, at boot. That single fact explains most install failures: a resource that needs the database cannot start before the database bridge, and a script that calls the ox_lib global cannot start before ox_lib. Your config file is a dependency graph written as a list.

Use ensure, not start. The Cfx.re server commands reference defines start as starting the resource if it was stopped, and ensure as restarting the resource if it was started and starting it if it was not. On a fresh boot they do the same thing. The moment you re-exec the config, hot-reload after an edit, or run the line twice from the live console, start silently does nothing while ensure gives you the current files running. Note also that both accept a category name, so ensure [var] starts everything in that bracketed folder at once, which is handy but hides the load order inside the category.

# ---- database first, before anything that queries -------------------
set mysql_connection_string "mysql://user:password@localhost:3306/yourdb"
ensure oxmysql

# ---- shared libraries ------------------------------------------------
ensure ox_lib

# ---- framework -------------------------------------------------------
ensure es_extended        # or: ensure qb-core

# ---- interaction, inventory, everything the scripts talk to ----------
ensure ox_target
ensure ox_inventory

# ---- your scripts, last ----------------------------------------------
ensure Var-Bank
# ensure [var]            # starts the whole category instead

Keep the connection string above the resource lines. The oxmysql documentation says to add the resource to the top of your resource list and to configure the connection string before starting any resources, and it accepts two formats: mysql://user:password@host:3306/database or the semicolon form user=root;password=12345;host=localhost;port=3306;database=fivem. Avoid the reserved characters in your password, since a stray @ or : in a URI-style string silently truncates the credentials.

The dependencies nobody mentions in the product page

A modern FiveM script is rarely standalone. It expects a library, a database bridge, a framework, usually a targeting resource and often an inventory. Missing one of them produces a Lua error that names a nil global rather than a missing resource, which is why beginners think the script is broken when it is simply alone on the server.

The manifest can enforce part of this for you. The resource manifest reference documents dependency and dependencies, which require the listed resources to load first, and they also accept runtime constraints such as '/server:4500' for a minimum server build, '/onesync' for state awareness and '/gameBuild:h4' for a game build. When a script you install declares them, a wrong server artifact fails loudly at start instead of producing a nil native somewhere in a client file.

fx_version 'cerulean'
game 'gta5'

dependencies {
    'ox_lib',
    'oxmysql',
    '/server:4500',
}

shared_script '@ox_lib/init.lua'   -- how ox_lib is consumed

client_script 'client/*.lua'
server_script 'server/*.lua'

escrow_ignore {                     -- files left readable in an escrow build
    'config.lua',
    'locales/*.lua',
}

Choosing between the two big frameworks changes which of these lines you will write for the rest of the server life. The differences in player API, money handling and database schema are laid out in ESX vs QBCore.

Importing the SQL file and registering the items

If the resource ships a sql/ folder, the tables have to exist before the first query runs. Our own documentation is a fair sample of what this looks like in practice: Var-Bank creates bank_user and bank_transactions, and Var-Drugs creates drug_lab and lab_logs. Import through HeidiSQL, phpMyAdmin, or the command line, into the same database your connection string points at.

# from the resource folder, into the database in mysql_connection_string
mysql -u fivem -p yourdatabase < sql/var-bank.sql

# check it landed before restarting the resource
mysql -u fivem -p -e "SHOW TABLES FROM yourdatabase LIKE 'bank_%';"

Items are the other half. A script that hands you a joint, a lockpick or a bank card does not define that item: the inventory does. Where you write it depends on which inventory you run. In ox_inventory the definitions live in data/items.lua keyed by item name, and the docs note that with ESX you can keep using ESX.RegisterUsableItem. In QBCore the same list lives in qb-core/shared/items.lua, in the format used by the built-in entries such as the lockpick.

-- ox_inventory/data/items.lua
['bank_card'] = {
    label = 'Bank Card',
    weight = 10,
    stack = false,
    close = true,
    client = {
        usetime = 2500,
    }
},

-- qb-core/shared/items.lua
bank_card = { name = 'bank_card', label = 'Bank Card', weight = 10,
  type = 'item', image = 'bank_card.png', unique = true, useable = true,
  shouldClose = true, description = 'Your card, do not lose it' },

Two details that cost people an evening: drop the item PNG in the inventory image folder or the slot renders blank, and restart the inventory resource rather than the script, because the item table is loaded by the inventory at its own start.

Var-BankA concrete example of everything above: two SQL tables to import, an ensure line after the framework, ESX and QBCore society accounts, and a documented install page per step.View the script

Verifying the install and reading the first error

Check the server console first. At boot each resource prints a started line, and a resource that failed prints why on the line above. If your script is simply absent from the log, the config never mentioned it: run refresh in the live console to rescan the resources folder, then ensure YourScript, and watch what comes back.

Then go in game. The Cfx.re client manual puts it plainly: these commands can be used with the client console, which you can open by pressing F8. That console is where every client side Lua error lands, and a client error will make a script look dead while the server swears it is running. Useful trick while testing: con_miniconChannels script:* prints script output on screen without opening the console, so you can watch errors while walking to the shop.

[  script:Var-Bank] SCRIPT ERROR: @Var-Bank/client/main.lua:112:
    attempt to index a nil value (global 'lib')
> handler (@Var-Bank/client/main.lua:112)

Read it right to left. The last parenthesis gives you the file and the line, the bracket at the start gives you the resource, and the message gives you the cause. A nil global named lib is ox_lib missing or starting after Var-Bank, not a bug in Var-Bank. Same grammar for ESX, QBCore or exports.ox_inventory. Once it runs, keep an eye on what it costs: resmon in the same F8 console gives you the per-resource millisecond cost, and the optimization guide explains what a healthy number looks like.

The seven errors that break the first install

Almost every failed install is one of these. Work down the list in order, because the top entries mask the bottom ones: a resource that never started cannot complain about a missing table.

The cache one deserves a note because it is invisible from the server. The Cfx.re troubleshooting page tells you to delete caches.xml from your FiveM application data folder, and to delete the entire application data folder if that file is not there. Do it on your own client after every UI update of a script, and tell your players to do it once when you push a new version of anything with a NUI page. It costs one reconnect and saves a support thread.

Last piece of honest advice: install one script at a time and start the server between each. Dropping six resources in at once and hitting restart turns a two-minute diagnosis into an evening of bisecting, and the console errors from the first broken resource will hide everything the other five have to say.

Related: How to make a FiveM server · FiveM escrow vs open source · Var script documentation