Installation
The complete install workflow, fully explained. In one sentence: active license → download the resource → drop it into your server → create the server in the panel → set your keys + load order in server.cfg → restart and validate.
Prerequisites
- An active Baobab AC license on your account (check Profile).
- A RedM server with
oxmysqlalready installed and working, on any RedM framework. - Access to your server files and the ability to edit
server.cfgand restart. - Outbound HTTPS from your server to the Baobab AC API (
api.twiste-services.net) - Baobab reports detections and validates players over this connection, so a restrictive egress firewall will block it.
1 · Verify your license
- 1Open your profile
Go to Profile and confirm your subscription shows as Active.
- 2No active license yet?
Choose a plan on Pricing and complete checkout. Access unlocks once payment is confirmed.
2 · Download the resource
From Profile, click Download. This downloads baobab.zip - the same package for everyone; your credentials are configured separately in server.cfg (step 5), not baked into the download.
3 · Place the files
- 1Extract into your resources folder
For example:
resources/[twiste]/baobab. - 2Keep the structure intact
The folder must contain
fxmanifest.luaplus theclient/,server/andshared/folders at its root.
baobab. A double-nested baobab/baobab is the #1 install mistake - the server won't find fxmanifest.lua and the resource will never start.4 · Create your server in the panel
- 1Open Servers → New server
Go to Servers and create a new entry.
- 2Choose a Server ID
A short, unique identifier such as
my-server-01. It labels the server in the panel only - it never goes into server.cfg. Your API key alone identifies the server. Name, IP and port are optional metadata. - 3Copy your keys
On creation the panel shows an API Key and an HMAC Secret. Copy them immediately - for security they are shown only once. Lost them? Use Rotate keys on the server card to generate a fresh pair (this invalidates the old ones).
5 · Configure server.cfg
Two things matter here: your credentials and your load order. Add your keys, then ensure baobab loads right after oxmysql.
# ── Baobab AC credentials (from the panel) ─────────────────
set ac_api_key "YOUR_API_KEY" # API Key shown on server creation
# Optional (recommended from day one): identify players by Steam; omit and Baobab uses the Rockstar license
set steam_webApiKey "STEAM_WEB_API_KEY"
# ── Load order (critical) ─────────────────────────────────
ensure oxmysql
ensure your_framework_core # your framework core, whichever it is
ensure baobab
# ── Everything else after ─────────────────────────────────
ensure your_other_resourcesset for your credentials, never setr. A setr convar is replicated to every connected client, so your API key would be readable by any player. set keeps the value server-side - exactly where Baobab reads it.| Convar | What to set it to | Required |
|---|---|---|
ac_api_key | The API Key shown when you created the server. | Yes |
ac_backend_endpoint | Leave unset - defaults to the official API. | No |
ac_framework | Force a framework instead of letting it auto-detect: vorp, rsg, qbr, redemrp or standalone. | No |
steam_webApiKey in your server.cfg to identify players by Steam - a stronger anti-evasion anchor, recommended from day one. Leave it out and Baobab falls back to the Rockstar license (always present on RedM), which is fully functional. Both work - but pick one at launch: adding Steam later re-keys your existing players as new.server.cfg. Just keep the secret somewhere safe in case you need it for support.6 · Exempt your staff (optional)
Admins testing the server can trip detections. baobab automatically exempts anyone in the group.admin or group.moderator ACE groups. Add your staff as principals and grant the /ac admin commands:
# Make your staff members part of an admin group
add_principal identifier.steam:110000100000000 group.admin
# Let that group use /ac admin commands and receive update notices
add_ace group.admin command.ac allowserver.cfg. See Configuration.7 · Restart and validate
- 1Restart the server
A full restart picks up the new resource and your server.cfg changes.
- 2Read the console
baobab logs its startup and version. No errors = good. If it doesn't start, see Troubleshooting.
- 3
About auto-updates
baobab keeps itself current. It checks for new versions about once an hour and downloads them straight to disk. The new files apply on your next server restart - the resource never restarts itself, so there’s nothing to configure and no special permission to grant.
Go-live checklist
- License active on Profile
- Resource downloaded and extracted as
resources/[twiste]/baobab - Server created in the panel; API Key + HMAC Secret saved
ac_api_keyset inserver.cfg- Load order:
oxmysql→ your framework core →baobab - Staff exempted via
group.admin/group.moderator(optional) - Server restarted, no console errors, showing online in the panel
Still stuck?
If this page did not answer your question, ask on Discord or write to us. Both reach the people who build Baobab AC.
New to the product? Start with the overview: Baobab anticheat, detections and panel on a single page.