On this page
Setup

Installation

The complete install workflow, fully explained. In one sentence: active license → download the resource → drop it into your server → create the server in the panel → set your keys + load order in server.cfg → restart and validate.

Prerequisites

  • An active Baobab AC license on your account (check Profile).
  • A RedM server with oxmysql already installed and working, on any RedM framework.
  • Access to your server files and the ability to edit server.cfg and restart.
  • Outbound HTTPS from your server to the Baobab AC API (api.twiste-services.net) - Baobab reports detections and validates players over this connection, so a restrictive egress firewall will block it.

1 · Verify your license

  1. 1
    Open your profile

    Go to Profile and confirm your subscription shows as Active.

  2. 2
    No active license yet?

    Choose a plan on Pricing and complete checkout. Access unlocks once payment is confirmed.

2 · Download the resource

From Profile, click Download. This downloads baobab.zip - the same package for everyone; your credentials are configured separately in server.cfg (step 5), not baked into the download.

3 · Place the files

  1. 1
    Extract into your resources folder

    For example: resources/[twiste]/baobab.

  2. 2
    Keep the structure intact

    The folder must contain fxmanifest.lua plus the client/, server/ and shared/ folders at its root.

Watch the folder name
The resource folder must be named exactly baobab. A double-nested baobab/baobab is the #1 install mistake - the server won't find fxmanifest.lua and the resource will never start.

4 · Create your server in the panel

  1. 1
    Open Servers → New server

    Go to Servers and create a new entry.

  2. 2
    Choose a Server ID

    A short, unique identifier such as my-server-01. It labels the server in the panel only - it never goes into server.cfg. Your API key alone identifies the server. Name, IP and port are optional metadata.

  3. 3
    Copy your keys

    On creation the panel shows an API Key and an HMAC Secret. Copy them immediately - for security they are shown only once. Lost them? Use Rotate keys on the server card to generate a fresh pair (this invalidates the old ones).

5 · Configure server.cfg

Two things matter here: your credentials and your load order. Add your keys, then ensure baobab loads right after oxmysql.

server.cfg
# ── Baobab AC credentials (from the panel) ─────────────────
set ac_api_key "YOUR_API_KEY"             # API Key shown on server creation

# Optional (recommended from day one): identify players by Steam; omit and Baobab uses the Rockstar license
set steam_webApiKey "STEAM_WEB_API_KEY"

# ── Load order (critical) ─────────────────────────────────
ensure oxmysql
ensure your_framework_core                # your framework core, whichever it is
ensure baobab

# ── Everything else after ─────────────────────────────────
ensure your_other_resources
Use set for your keys, never setr
Always use set for your credentials, never setr. A setr convar is replicated to every connected client, so your API key would be readable by any player. set keeps the value server-side - exactly where Baobab reads it.
ConvarWhat to set it toRequired
ac_api_keyThe API Key shown when you created the server.Yes
ac_backend_endpointLeave unset - defaults to the official API.No
ac_frameworkForce a framework instead of letting it auto-detect: vorp, rsg, qbr, redemrp or standalone.No
Steam is optional - decide once
Set steam_webApiKey in your server.cfg to identify players by Steam - a stronger anti-evasion anchor, recommended from day one. Leave it out and Baobab falls back to the Rockstar license (always present on RedM), which is fully functional. Both work - but pick one at launch: adding Steam later re-keys your existing players as new.
HMAC is handled for you
The HMAC Secret authenticates your server's requests and is managed automatically by the panel - you do not need to add an HMAC convar to server.cfg. Just keep the secret somewhere safe in case you need it for support.
Detections start alert-only
Out of the box Baobab AC is alert-only: even in Servers.
Discord bot depends on your plan
Discord webhook alerts are available on every plan. The Discord bot - richer alerts plus in-game moderation from Discord - is included on the Pro and Network plans, not on Starter. See our pricing.

6 · Exempt your staff (optional)

Admins testing the server can trip detections. baobab automatically exempts anyone in the group.admin or group.moderator ACE groups. Add your staff as principals and grant the /ac admin commands:

server.cfg
# Make your staff members part of an admin group
add_principal identifier.steam:110000100000000 group.admin

# Let that group use /ac admin commands and receive update notices
add_ace group.admin command.ac allow
Prefer per-player exemptions?
You can also exempt specific players by Steam hex directly from the panel without touching server.cfg. See Configuration.

7 · Restart and validate

  1. 1
    Restart the server

    A full restart picks up the new resource and your server.cfg changes.

  2. 2
    Read the console

    baobab logs its startup and version. No errors = good. If it doesn't start, see Troubleshooting.

  3. 3
    Check the panel

    Your server shows online on Servers, and Dashboard begins populating as players join.

About auto-updates

baobab keeps itself current. It checks for new versions about once an hour and downloads them straight to disk. The new files apply on your next server restart - the resource never restarts itself, so there’s nothing to configure and no special permission to grant.

Want to control updates?
Auto-download is on by default. To stage updates without auto-applying, or to disable the check entirely, see the auto-update convars in Configuration.

Go-live checklist

Before you call it done
  • License active on Profile
  • Resource downloaded and extracted as resources/[twiste]/baobab
  • Server created in the panel; API Key + HMAC Secret saved
  • ac_api_key set in server.cfg
  • Load order: oxmysqlyour framework corebaobab
  • Staff exempted via group.admin / group.moderator (optional)
  • Server restarted, no console errors, showing online in the panel

Still stuck?

If this page did not answer your question, ask on Discord or write to us. Both reach the people who build Baobab AC.

New to the product? Start with the overview: Baobab anticheat, detections and panel on a single page.