Introduction

FeloxAC is a modular anti-cheat system for FiveM. It combines client-side detection modules with a server-side authority layer and a web dashboard, protecting your server against cheats, injectors, and exploited resources.

These docs cover everything you need to get FeloxAC running and integrated with your own resources:

• Installation — license, resource placement, server.cfg, and the protection installer.
• Configuration — detections, punishment modes, and the Safe Events / Safe Scripts allowlists that stop false bans.
• False Bans — why they happen and how to fix them.
• Developer API (Exports) — every export FeloxAC provides to other resources.
• Ban Export — the banPlayer export in detail.
• Usage Examples — copy-paste integration recipes.

What FeloxAC protects against

How it works

1. Client detection modules watch for cheat behaviour on each player and report to the server.
2. The server layer is authoritative — it confirms detections, applies the configured punishment (ban / kick / log), and records evidence (screenshots and gameplay clips) to your Discord webhooks.
3. The dashboard is the single source of truth for configuration. Settings are synced to your running server automatically and can be reloaded live with fac reload.

Requirements

Installation

Installing FeloxAC takes five steps: get a license, add the resource, set your license.txt, update server.cfg, and run the protection installer.

Prerequisites

Step 1 — Get your license

1. Purchase a license at feloxac.com.
2. Open your dashboard and go to Redeem Key.
3. Choose Create a new server, then paste your license key, enter your public server IP (set only once), enter a server name, and click Add Server.

Step 2 — Add the resource

1. Download the FeloxAC resource from your dashboard's Download page.
2. Extract it into your server's resources/ folder.
3. Make sure the folder is named FeloxAC.

Step 3 — Configure license.txt

1. Open license.txt inside the FeloxAC folder and delete everything in it.
2. In your dashboard, go to Documentation → Replace license.txt.
3. Select your server, click Copy license.txt Content, and paste it into license.txt.
4. Save the file.

This file contains your API token. FeloxAC reads it at startup and validates it against feloxac.com for your server IP.

Step 4 — Configure server.cfg

Add OneSync near the top of your server.cfg:

set onesync on
set onesync_population false

Add these among your other permission lines:

add_unsafe_child_process_permission "FeloxAC"
add_ace resource.FeloxAC command allow

Add the ensure line at the very top of your ensure list, before every other resource:

ensure FeloxAC

Step 5 — Run the protection installer

Copying the resource is not enough — you must run the installer once so FeloxAC protects your other scripts.

1. Start your server.
2. Open the Live Console (txAdmin or the server console) and run:

   fac install smart

3. Wait for the installation to finish.
4. Restart your server. FeloxAC is now active.

What fac install smart does

It scans every resource and installs FeloxAC protection only into scripts that use network events. Resources with no network events (vehicles, peds, maps, libraries) are skipped automatically, so the install stays fast and clean.

Other install modes

Verify the installation

• Run status (or check txAdmin) — FeloxAC should appear in the resource list.
• The server console prints FeloxAC's startup and license validation result.
• Connecting players are logged (join/leave) if connection logging is enabled.

Troubleshooting

License is invalid / players get kicked

• Confirm license.txt contains the exact token from your dashboard.
• Confirm your server's public IP matches the IP registered for the license.
• Make sure the server can reach https://feloxac.com (check firewall / hosts file). FeloxAC is fail-closed — if it cannot validate the license it stops and kicks players by design.

fac command not found

• Confirm the FeloxAC resource is running (status).
• The command prefix is fac, not feloxac. If you changed CommandPrefix in config, use your custom prefix.

Detections not firing after install

• Confirm ensure FeloxAC is at the top of your ensure lines.
• Confirm OneSync is on (set onesync on).
• Confirm your server build is 14317+.
• Re-run fac install smart and restart.

Configuration

FeloxAC is configured from your dashboard. Everything is done through the panel — toggles, dropdowns, and list ("chip") inputs — so you never edit raw config files by hand.

Changes are synced to your running server automatically. To apply them immediately, run:

fac reload

How the panel works

• Toggles turn a detection on or off.
• Dropdowns choose the action for a detection (Ban / Kick / Log).
• Lists (chips) hold multiple values — such as Safe Events, Safe Scripts, and the white/black lists. To add an item, type it into the "New item, press enter to add…" box and press Enter. To remove one, click the ✕ on its chip.

Sections at a glance

Punishment modes (Ban / Kick / Log)

Safe Events — stop false bans from events

Where: Settings → Safe Events list.

Some legitimate scripts give a weapon or teleport a player through a network event. If that event trips a detection, honest players get false-banned. Add the offending event name to Safe Events and FeloxAC will skip weapon-give / teleport detection for it.

How to add one: type the event name into the Safe Events box and press Enter — for example job:teleportToWork or police:warpToStation. It appears as a chip in the list.

How to find the event name:

• Check the detection log / Discord evidence — the triggering event is included in the ban details.
• Or check the script's source for the TriggerServerEvent / TriggerClientEvent name it fires when teleporting or giving the weapon.

Safe Scripts — trust a whole resource

Where: Settings → Safe Scripts list.

Where Safe Events whitelists a single event, Safe Scripts trusts an entire resource. Add a resource here when it legitimately teleports players or gives weapons and you don't want to whitelist each event individually — for example job systems, rental systems, admin menus, or weapon shops.

How to add one: type the resource name into the Safe Scripts box and press Enter (for example my-rental-system). Matching is case-insensitive.

Ignored Scripts — fully exclude a resource

Where: Settings → Ignored Scripts list.

Ignored Scripts disables all FeloxAC checks for a resource — weapons, entities, events, everything. Use it only for a fully trusted resource that is otherwise incompatible with the anti-cheat.

Which one should I use?

White lists & black lists

Entities and weapons use the same chip inputs. Type a model name or hash (or weapon name) and press Enter.

Key detection toggles

Main

Weapons

Entities

False Bans

Almost every false ban comes from an object, a vehicle, or a ped. In the vast majority of cases it is not the detection that is wrong — it is one of two things:

1. The anti-cheat was not fully installed (the protection installer was never run), or
2. Your server basics are not set up correctly (OneSync / license), or
3. A legitimate resource keeps spawning the same entity, which just needs to be whitelisted.

Step 1 — Check your setup first

Most false bans disappear the moment the basics are correct:

• OneSync is ON — set onesync on
• OneSync population is OFF — set onesync_population false (this one is the most commonly forgotten)
• You have a paid FiveM (Keymaster) account — free / unlicensed setups cause detection problems
• You ran the installer — fac install smart, then restarted the server

If any of these is missing, fix it and test again before whitelisting anything.

Ped false bans

If players are getting false-banned from a ped, it is almost always one of these:

• OneSync is not on
• No paid FiveM Keymaster account
• onesync_population is not set to false (the forgotten command)
• fac install smart was not run

Fix those first. If the ban always comes from the same ped, that ped is legitimate — add its model to the White Listed Peds list.

Object false bans

• If the anti-cheat keeps banning from objects in general, fac install smart was most likely not run, so the protection was never installed. Run it and restart.
• If the ban is always from the same object, that object is legitimate — add it to the White Listed Objects list.

Vehicle false bans

• Make sure fac install smart has been run and the server restarted.
• If a specific, legitimate vehicle is repeatedly flagged, add it to the White Listed Vehicles list.

How to whitelist a model

Whitelisting is done from the dashboard, using the chip inputs:

• White Listed Peds — for peds
• White Listed Objects — for objects
• White Listed Vehicles — for vehicles

Type the model (name or hash) into the "New item, press enter to add…" box and press Enter. Then run fac reload (or restart) to apply.

When it's a script, not an entity

If the false ban is caused by a resource that teleports players or gives weapons (not by a spawned entity), use Safe Events or Safe Scripts instead — see Configuration.

Developer API (Exports)

FeloxAC exposes exports so your resources can ban/kick players, read player state, and tell the anti-cheat when an action is legitimate (admin teleports, heals, weapon gives, and so on).

All exports are called on the FeloxAC resource:

exports['FeloxAC']:exportName(args)

Server exports

Moderation

-- Ban a player for 1 hour (3600 seconds)
exports['FeloxAC']:banPlayer(source, 'Aimbot', { by = 'Admin' }, 3600)

-- Unban by id
exports['FeloxAC']:unbanPlayer('BAN-ID-HERE', 'Appeal accepted', 'HeadAdmin')

Player state

Configuration

Legitimate-action markers (server)

These tell FeloxAC that an action performed by your script is intentional, so a detection does not fire. They are not security bypasses — they scope an allowance to a specific action.

-- Admin teleports a player without a false ban
exports['FeloxAC']:markExternalTeleport(target)
SetEntityCoords(GetPlayerPed(target), x, y, z)

Client exports

Legitimate-action markers (client)

Godmode / player state (client)

Weapons & damage (client)

Entities, camera & evidence (client)

Ban Export

Use the banPlayer export to ban a player from any server-side script — your admin menu, a custom detection, a report system, and so on. The ban is applied through the same pipeline FeloxAC uses internally, so it is recorded in your ban list, synced to the dashboard, and logged to Discord.

Signature

exports['FeloxAC']:banPlayer(source, reason, details, duration)

Returns: a boolean indicating whether the punishment was applied.

Examples

Permanent ban

-- Omitting duration uses your configured BanDuration (default: permanent)
exports['FeloxAC']:banPlayer(source, 'Cheating')

-- Or be explicit
exports['FeloxAC']:banPlayer(source, 'Cheating', nil, -1)

Temporary ban

-- Ban for 1 day (86400 seconds)
exports['FeloxAC']:banPlayer(source, 'Toxic behaviour', { by = 'Moderator' }, 86400)

Ban with rich details

exports['FeloxAC']:banPlayer(source, 'Money exploit', {
    by       = 'AutoDetect',
    amount   = 500000,
    resource = GetCurrentResourceName(),
}, -1)

Ban from an admin command

RegisterCommand('myban', function(src, args)
    local target = tonumber(args[1])
    local reason = table.concat(args, ' ', 2)
    if not target or reason == '' then
        return print('Usage: myban [id] [reason]')
    end
    exports['FeloxAC']:banPlayer(target, reason, { by = GetPlayerName(src) }, -1)
end, true) -- restricted command

Ban from another resource via an event

-- In your other resource (server side)
RegisterNetEvent('myac:ban', function(targetId, reason, seconds)
    exports['FeloxAC']:banPlayer(targetId, reason, { by = 'myac' }, seconds or -1)
end)

Related exports

Usage Examples

Copy-paste patterns for the most common integrations. All exports are called on the FeloxAC resource.

Admin teleport without a false ban

Mark the teleport as legitimate right before you move the player.

Server side:

RegisterCommand('tp', function(src, args)
    local target = tonumber(args[1]) or src
    exports['FeloxAC']:markExternalTeleport(target)
    -- ... perform your teleport (SetEntityCoords on the target's ped) ...
end, true)

Client side (if you teleport locally):

exports['FeloxAC']:markExternalTeleport()
SetEntityCoords(PlayerPedId(), x, y, z, false, false, false, false)

Admin heal / revive without a false ban

-- Client side, before healing/reviving
exports['FeloxAC']:markExternalHeal()
SetEntityHealth(PlayerPedId(), 200)

-- After a revive
exports['FeloxAC']:playerRevived()

Give a weapon from a trusted script

The cleanest option is to add your resource to the Safe Scripts list in the dashboard, so its weapon gives are always trusted (see Configuration).

For a per-action allowance from client code instead:

exports['FeloxAC']:giveWeapon(GetHashKey('weapon_pistol'), 'my-weapon-shop')

Ban a cheater from your own detection

-- Server side
if isCheating then
    exports['FeloxAC']:banPlayer(source, 'Custom detection: money exploit', {
        by = GetCurrentResourceName(),
    }, -1)
end

See the Ban Export page for full details.

Gate content by threat score

-- Server side: deny a sensitive action to high-threat players
local score = exports['FeloxAC']:getThreatScore(source) or 0
if score > 75 then
    TriggerClientEvent('chat:addMessage', source, { args = { 'System', 'Action temporarily unavailable.' } })
    return
end

Collect evidence on demand

-- Server side: screenshot a suspicious player and post it to Discord
exports['FeloxAC']:screenshot(source, 'https://discord.com/api/webhooks/...')

-- Grab the last ~10 seconds of their gameplay
exports['FeloxAC']:captureLastSeconds(source, 'https://discord.com/api/webhooks/...')

Fix false bans from a job / rental script

If a specific event from a script teleports players or gives them items and causes false bans, add just that event to the Safe Events list in the dashboard (type the event name, press Enter). If the whole resource is trusted, use Safe Scripts instead.

Spawn entities that the anti-cheat trusts

-- Client side
local veh = exports['FeloxAC']:CreateVehicle(GetHashKey('adder'))

-- Server side
local ent = exports['FeloxAC']:CreateEntity(GetHashKey('prop_barrier_work05'))

Reload configuration after changes

exports['FeloxAC']:ReloadConfiguration()

Or from the console:

fac reload