The words this market uses, defined.

FiveM is a multiplayer modification framework for the PC version of Grand Theft Auto V that lets people run custom servers, most famously roleplay servers.

FiveM runs a custom server alongside a player's own legal copy of GTA V, loading community-written resources — scripts, maps, vehicles — that the base game never shipped. It is the platform virtually all GTA roleplay runs on. Its developer, Cfx.re, was acquired by Rockstar Games in 2023, which moved FiveM from tolerated to official.

Cfx.re is the organisation behind FiveM and RedM, acquired by Rockstar Games in 2023.

Cfx.re maintains the FiveM and RedM platforms, the forum where the community organises, the keymaster licensing system, and — since January 2026 — an official marketplace for paid resources. Its acquisition by Rockstar in 2023 is why FiveM now has a sanctioned commercial layer rather than an improvised one.

Asset escrow is Cfx's system for encrypting a FiveM resource's protected files and binding them to a buyer's server licence, so the code runs but cannot be read or edited.

Escrow protects a seller's work from being copied and resold. The cost lands on the buyer: escrowed files can't be audited, debugged deeply, or customised. Escrow itself isn't the problem — undisclosed escrow is. A seller should tell you exactly which files ship open and which ship locked, before you pay.

resmon is FiveM's built-in resource monitor, opened with `resmon 1` in the F8 console, showing how many milliseconds per frame each running resource consumes.

resmon is the only tool that matters for diagnosing script performance. A frame at 60fps is 16.67ms shared across everything running. A well-engineered resource idles at 0.00–0.02ms and stays under about 0.10ms while actively used. resmon is also how you check a seller's performance claim yourself — which is why claims without a method and a date mean little.

Qbox is a modern FiveM roleplay framework descended from QBCore, built around the ox_lib and oxmysql stack.

Qbox is a maintained fork of QBCore that adopted the ox ecosystem as its foundation rather than carrying QBCore's older internals forward. It appeals to servers that want the QBCore resource lineage with tighter, more current plumbing. It's newer, so its ecosystem is smaller than ESX's or QBCore's.

QBCore is a widely used FiveM roleplay framework with the broadest mid-era resource library.

QBCore became the default choice for a large wave of roleplay servers and carries an enormous library of community and paid resources written against it. Its breadth is its strength; its age shows in its internals, which is what motivated Qbox.

ESX Legacy is the long-running FiveM roleplay framework with the deepest legacy ecosystem.

ESX is the oldest of the three mainstream frameworks and has the largest accumulated body of resources, tutorials, and servers. Choosing it means the widest availability of existing work and the heaviest historical baggage.

ox_lib is a shared library of common FiveM building blocks — UI, callbacks, and utilities — used across the ox ecosystem and by Qbox.

ox_lib gives resources one consistent implementation of the things every script needs, instead of every author reinventing menus and callbacks. Resources built on it inherit its behaviour and its performance characteristics.

oxmysql is the standard asynchronous MySQL/MariaDB connector for FiveM resources.

oxmysql handles database access without blocking the server thread. It matters for performance because a synchronous or badly-placed query — especially one inside a per-frame loop — turns a small frame cost into a frame cost plus a database round trip.

OneSync is FiveM's server-side entity synchronisation system, which raised player limits well beyond the base game's.

OneSync moves entity ownership and synchronisation authority to the server, enabling high player counts. Its configuration is one of the honest suspects when lag correlates with player count rather than with a specific in-game action.

Tebex is the payment and delivery platform most FiveM stores use to sell resources, and the merchant of record for the Cfx.re Marketplace.

Tebex handles checkout, tax, and licence delivery for most of this market — including the official Cfx.re Marketplace. Its ubiquity is why storefronts across the market look similar, and why the currency you see displayed isn't always the currency you're charged.

Grand Theft Auto V is the 2013 Rockstar Games title whose PC version FiveM extends, and the game all GTA roleplay currently runs on.

Every FiveM roleplay server is GTA V underneath. This is why the GTA 6 question matters commercially: GTA 6 launches November 19, 2026 on PS5 and Xbox Series X|S with no PC version announced, and no modding or roleplay support announced. Until that changes, PC roleplay stays on GTA V.

Lua is the scripting language FiveM resources are written in; current resources target Lua 5.4.

FiveM resources are predominantly Lua. The language isn't the performance problem people assume — a Lua resource idling at 0.00ms and one burning 0.5ms per frame are the same language making different choices about loops.

A net event is a message a FiveM client sends to the server (or vice versa) — and any client can trigger any registered server event with any payload.

This is the root of most FiveM exploits. Because a player's client can fire any registered server event with arguments of its choosing, a server must validate the source, the permission, the rate, and the argument types on every event, and must never trust a client-sent amount or position.

Ledger drift is the gap between what a transaction history says balances should be and what the balances table actually holds.

Drift is created by non-atomic writes interrupted by a crash. It's the failure mode that quietly destroys a roleplay economy: money appears or vanishes with no exploit involved. A sound economy script reconciles to zero drift across repeated kill-mid-transaction tests.

A resource is FiveM's formal name for a script: a folder containing an fxmanifest.lua and the client, server, and shared files it declares.

Everything a server runs — frameworks, maps, vehicles, UI, gameplay systems — is a resource, started by name from server.cfg with `ensure`. The folder name is the resource name, which is why renaming a folder breaks dependencies that reference it. A commercial script is one resource, sometimes a few.

fxmanifest.lua is the manifest file at the root of every FiveM resource, declaring its target version, which files run where, its dependencies, and its metadata.

FXServer reads the manifest before running any of a resource's code, so a missing required field or a syntax error stops the resource from starting at all. Because it is structure rather than logic, it usually ships readable even on escrowed products — which makes it the fastest honest read on a script before you buy: its dependencies, its UI page, and often which files the seller exempted from encryption.

server.cfg is the FXServer configuration file that sets convars, the licence key, and the order in which resources start.

Resources start in the order server.cfg lists them, and a resource that needs a database or another resource's export during its own startup needs that dependency already running. Most 'broken' new installs are a server.cfg ordering mistake: database layer, then framework, then shared libraries, then everything that depends on them.

`ensure` is the server.cfg directive that starts a resource and restarts it cleanly if it is already running, replacing the older `start`.

Because ensure is idempotent, it is the safe way to declare a resource; because server.cfg is processed top to bottom, the position of each ensure line is the load order. A resource ensured above its own dependency produces nil-value errors that look like a broken script.

Load order is the sequence in which FXServer starts resources, set by the order of ensure lines in server.cfg.

The reliable order is database connector, framework core, shared libraries such as ox_lib, inventory and target, then everything that depends on them. Reversed order does not fail loudly at boot; it fails when a resource calls an export that does not exist yet, which is why load-order faults are so often misdiagnosed as script bugs.

An FXServer artifact is a specific build of the FiveM server binary, identified by number, that a server runs.

Cfx publishes artifacts continuously and marks some as recommended. Because scripts, frameworks, and natives can behave differently between builds, the artifact number is part of the conditions any performance or compatibility claim needs — a resmon figure without the artifact it was measured on is not comparable to yours.

A convar is a named configuration variable set in server.cfg (or the console) that resources read at runtime, such as the database connection string.

Convars carry the settings that must not live inside a resource's files: `mysql_connection_string` for oxmysql, the licence key, OneSync mode, and any secret a script needs. A convar that is unset or mistyped is behind a large share of fresh-server failures, and convars containing secrets should never be pasted into a support ticket unredacted.

txAdmin is the web-based server management panel bundled with FXServer: deploys, restarts, live console, scheduled restarts, and player moderation.

txAdmin manages the server process — it knows the server is running and who is connected — but it does not record what happens inside resources. Staff actions taken through an in-game admin menu are not txAdmin's logs unless the admin resource writes them, which is why an audited in-game admin script is a separate decision. Its recipe deployer is also the fastest way to stand up a staging server.

Keymaster is the Cfx.re portal where a server owner generates the licence key an FXServer needs, and where purchased escrowed assets are granted to their account.

For escrowed resources the keymaster grant is the licence's technical form: the encrypted files check at load that the server's key belongs to an account holding the grant. A purchased asset that will not start on one server but runs on another is usually a key or grant problem — wrong account, regenerated key, unlinked purchase — not a code problem.

The Cfx.re Marketplace (marketplace.cfx.re) is the official, curated storefront for FiveM and RedM resources, launched by Cfx.re in January 2026.

Listings are reviewed before they go live; payment still runs through Tebex and escrowed assets still arrive as keymaster grants. It coexists with sellers' own Tebex storefronts rather than replacing them. Review checks that a listing is legitimate — it does not measure performance, audit security, or vouch for support, so the buyer's checklist is the same on the Marketplace as anywhere else.

A FiveM script licence is the seller's grant to run a resource, usually for one community, without the right to resell, share, or redistribute it.

A purchase buys the licence, not the code. Scope (one community versus one server), update entitlement within a major version, whether the grant can transfer when a server changes hands, and what revokes it — refund, chargeback, leaking — all vary by seller and are written only in the terms. For escrowed resources the grant is also enforced technically through keymaster.

escrow_ignore is the fxmanifest.lua field a seller uses to list the files of an escrowed resource that ship unencrypted.

It is the most honest thing on many listings, because it is code rather than copy: the files named there are the ones you can read and edit — typically config, locales, and bridge glue. If a seller's 'fully configurable' claim is not backed by an escrow_ignore list that includes the config, the claim is an adjective.

Server-authoritative is the design property where the FiveM server computes and decides every state change — prices, permissions, ownership, outcomes — and never writes a client-supplied fact to state without verifying it.

The property is binary at every handler: either the server derived the fact itself or it took the client's word for it. Because any player can run a modified client and fire any server event with any payload, a single client-trusting handler that reads an amount from the client is an ATM. Ask a seller how each money-moving event validates source, permission, rate, and argument types.

An export is a function a FiveM resource makes callable by other resources, declared in its manifest or registered at runtime, forming the resource's public API.

Exports are how scripts compose: a banking script exposes an export to move money, a garage script calls it. Documented, open exports are what let you build against a product and let a bridge translate between frameworks; undocumented or escrowed exports are a lock-in surface. A resource calling another's export during startup needs that resource already running.

A framework bridge is an adapter module through which a script talks to the framework — player, money, job, inventory — instead of calling framework internals directly.

A bridge-built script moves between Qbox, QBCore, and ESX with a bridge change; a script wired to framework internals must be rewritten to move. That difference is the entire cost of a framework migration, which is why the bridge question belongs at purchase time. A bridge that ships open lets you read exactly how a product touches your server.

A callback, in FiveM scripting, is the client-server pattern where a client requests a value and awaits the server's answer, standardised by ox_lib's `lib.callback`.

Before ox_lib every framework and many scripts shipped their own callback registrar, each with slightly different bugs. A shared implementation means one behaviour and one performance profile — and one dependency: a script using lib.callback requires ox_lib. The server side of a callback still has to validate the request like any other net event.

A statebag is FiveM's built-in mechanism for attaching replicated key-value state to an entity, a player, or the global scope, synchronised to clients automatically.

Statebags replace many hand-written sync events — a vehicle's lock state, a player's duty flag — and who is allowed to write a given key is a security decision: state a client can write is state a client can forge. A script that lets clients set their own statebag values for anything that gates a reward has handed the client authority.

NUI is FiveM's in-game web interface layer: a resource's HTML, CSS, and JavaScript rendered inside the game and wired to Lua through messages and callbacks.

Any script with a menu, tablet, or dashboard that looks like a web page is using NUI, declared through `ui_page` and a `files` block in the manifest. NUI focus is a shared resource — two scripts fighting over it is a common conflict shape — and NUI callbacks are net-event-like inputs that the server must validate rather than trust.

ox_inventory is the ox ecosystem's weight-based FiveM inventory with per-item metadata, stashes, shops, and crafting, built on ox_lib and oxmysql.

It replaces the framework's own inventory rather than sitting beside it, so installing it means disabling qb-inventory or the ESX default and letting ox_inventory own the items table. Because so many scripts give, take, or check items, the inventory is a dependency for half the server — which inventories a script supports, by name, is a coupling disclosure.

ox_target is the ox ecosystem's targeting system: look at an entity or zone and a menu of interactions appears. It is Qbox's standard, succeeding the qtarget lineage.

Like the inventory, the target system is a dependency other scripts declare. QBCore servers historically ran qb-target, and many resources support both through a small shim; a script written only against qb-target's API needs that shim or an edit to run on ox_target.

A tick loop is a `while true do ... Wait(n) end` loop in a FiveM script that runs every frame or every n milliseconds, whether or not anything is happening.

Per-frame loops doing work that changes far less often than every frame — distance checks, UI refreshes, database polls — are the most common cause of a high idle resmon reading. Event-driven code that runs only when something happens is almost always the fix, and a loop that keeps running after its feature closes is a leak.

Idle cost is what a resource burns in resmon when its feature is not in use; active cost is what it burns mid-use. A credible performance claim states both, with conditions.

A well-engineered resource idles at 0.00–0.02ms and stays under about 0.10ms in active use, returning to idle within seconds of the interaction ending. A single number with no state, artifact version, framework, or date attached is a target, not a measurement.

A race condition is a defect where two operations on the same state overlap, so the outcome depends on timing — in a FiveM economy, two withdrawals both succeeding against one balance.

The classic test fires around twenty concurrent transactions from one balance; exactly one should succeed. A script that reads a balance, checks it, then writes it back without a lock or an atomic database operation will eventually pay twice. Async database calls make this easier to get wrong, not harder.

A dupe is an item or money duplication exploit: any sequence of actions that leaves a player with more than they started with, without the server having intended it.

Dupes come from race conditions, client-trusting handlers, and non-atomic writes interrupted by a disconnect or restart. They are the single fastest way to destroy a roleplay economy, and 'dupe-proof' is a claim no honest seller makes — dupe-resistant, with the tests published, is the ceiling.

Restart safety is the property that every fact that matters — balances, cooldowns, due dates, in-flight transactions — is written somewhere durable before a restart, not held only in memory.

FiveM servers restart far more often than a feature demo accounts for: scheduled resets, updates, crashes. State held only in a Lua table resets or vanishes when the process dies, however well the feature worked five minutes earlier. The test is simple: exercise the feature, restart, and check whether it is still true.

A staging server is a second, disposable FiveM server mirroring production's framework, resource list, and database structure, used to test purchases and updates before players see them.

The rule that makes it worth the hosting cost: nothing production-only belongs on it — no live player data, no real secrets, no real payment webhooks. Every new resource lands here first for a restart check, a load check, and a client-trust check; migrations and updates are rehearsed here before they touch the city.

A citizen ID is the per-character identifier the QB lineage (QBCore, Qbox) uses to key a player's data, as distinct from ESX's licence-based identifier.

The difference in how frameworks identify a character is the first thing an ESX to Qbox migration has to map, because money, inventory, and vehicles all key off it. Keep the old-to-new lookup table; every other domain needs it.

An MDT — mobile data terminal — is the in-game police records system in FiveM roleplay: citizen profiles, reports, charges, warrants, and vehicle lookups, shared between officers and persisting across sessions.

Named for the terminals mounted in real patrol cars, the roleplay MDT is the database of record for the justice side of a server. It is a different product from dispatch, which owns the live call; the MDT owns the case afterward. Judge one on its record model — attribution, edit history, shared records with evidence — not its feature list.

A dispatch script owns the live incident in FiveM public-safety roleplay: call creation, priority, and which unit is actually assigned.

Its failure mode is chaos rather than corruption — one call becoming three cards, two units self-assigning to the same job. It hands the case to the MDT afterward, and a dispatch system that shares one record with the MDT and evidence chain is a system; one that does not is a notification.

An open-source FiveM resource ships with readable source and a licence that permits use and modification; it is distinct from free-to-download resources with hidden or escrowed code.

'Free' can mean three things — free with hidden source, genuinely open-source, or escrowed at $0 — and each carries different risk. Open source can be audited and fixed; it can also be abandoned. Check the last commit, open issues, and licence, then test it on staging like a paid script.