How to Install and Test QBCore Scripts

Set up QBCore scripts with a clear manifest and dependency list, then test configuration, locales, start order and server-side event checks before production.

Declare the resource boundary

Read the package README and release notes before editing anything. Take the resource folder, dependencies, configuration paths and any database migrations from that documentation, and run only documented migrations on staging. The manifest below is a structure example, not a substitute for the package instructions.

fx_version 'cerulean'
game 'gta5'

dependency 'qb-core'
shared_script 'config.lua'
shared_script 'locales/en.lua'
client_script 'client/main.lua'
server_script 'server/main.lua'

Customize configuration and locales safely

Review config.lua and supplied locale files before the first start. Keep server-specific values in configuration, copy only documented locale keys and retain the upstream default as a comparison point. Keep a change only if one person owns it, it survives an upstream update without a core patch, and it has passed staging before production.

Start dependencies first

In server.cfg, start qb-core before the script that depends on it. Install the database adapter required by your exact qb-core version before qb-core; the upstream core declares oxmysql. Check additional resource dependencies separately. Start every other documented dependency first, and use ensure only after verifying each resource folder name.

ensure qb-core
ensure your-resource

Validate events on the server

Treat client input as untrusted. Use network events only when data must cross client and server contexts, and validate permissions, ownership, position, inventory, money and state with server-side data before changing anything valuable. Do not let a client choose a reward, price, target player or privileged action without server checks.

Stage every change

Use a staging server with representative configuration and a disposable database. Start the resource from a clean restart, exercise its main player flow with an authorized and an unprivileged account, inspect server errors, then repeat after a resource restart. Record the exact version and configuration delta before production.

Primary sources: current qb-core source, Cfx resource-manifest documentation and Cfx server-security guidance.

Reference documentation

Source: qbcore-fivem/qb-core · Cfx.re — resource manifest · Cfx.re — server security