Package & Ship Your Resource

You wrote a working script. That is not the same as a resource someone else can install, trust, and run for a year. Shipping is its own skill: protecting your code without locking out the people who run it, and publishing only through channels that will not get your account banned. This lesson covers both the mechanics and the rules.

From "it runs" to "it ships"

A resource that works on your test server can still fail on someone else's. Shipping means making it portable and predictable: a clean fxmanifest.lua, a config owners can edit without touching your logic, no hardcoded job names or file paths, and a version number you actually bump.

It also means pinning one framework. Decide up front whether you target Qbox, QBCore, or ESX, and say so in your description. Do not ship a resource that half-supports three frameworks — that is the number-one source of "it errors on install" tickets. When you ask AI to help package, it loves to blend QBCore.Functions.GetPlayer with an ESX xPlayer in the same file. That code cannot run anywhere. Pick one, build a thin bridge if you must, and verify every export against the real framework reference before you trust it.

Asset Escrow: protect logic, not configs

Asset Escrow is Cfx.re's system for encrypting your resource so buyers can run it but not read or copy your source. Two manifest details matter most.

First, lua54 'yes'. The modern stack — ox_lib, ox_inventory, ox_target, Qbox — assumes Lua 5.4. Enable it on every new resource so features like lib.callback and integer math behave as documented.

Second, escrow_ignore. Escrow encrypts everything except the files you list here. You always leave configs and locales readable — owners need to edit prices, coordinates, and translations without your source. Anything not listed gets locked. Get this backwards and you either expose your logic or ship a resource nobody can configure.

One caution: escrow itself is applied when you upload to Keymaster, not by a magic manifest key. AI tools frequently invent fake directives like escrow 'yes' or protected 'true'. Those do not exist. The manifest only declares escrow_ignore; the protection happens server-side at upload. When in doubt, link to the official Cfx Asset Escrow docs and confirm the key exists before you paste it.

A real manifest

-- fxmanifest.lua is the first file the server reads.
-- It declares metadata, load order, and what Asset Escrow leaves readable.
fx_version 'cerulean'
game 'gta5'

author 'YourName'
description 'Qbox-only example resource — PlayDeck Module 13'
version '1.0.0'

-- Lua 5.4 unlocks integer math, bitwise ops, and faster GC.
-- The ox stack assumes it; turn it on for every new resource.
lua54 'yes'

-- ox_lib must load first so lib.* exists before your code runs.
shared_scripts {
    '@ox_lib/init.lua',
    'config.lua',
}

client_scripts { 'client/main.lua' }
server_scripts { 'server/main.lua' }

-- escrow_ignore = files that STAY readable after escrow.
-- Owners must edit configs and locales; never lock those away.
-- Everything NOT listed here is encrypted at upload time.
escrow_ignore {
    'config.lua',
    'locales/*.json',
}

-- Note: there is no 'escrow' key here. Protection is applied when you
-- upload this resource to Keymaster, not declared in the manifest.

Keymaster: where your resource becomes an asset

Keymaster is the Cfx.re portal that ties a resource to your account. You upload your packaged folder, it returns an asset that can be escrow-protected and granted to specific server keys. That grant is what lets a buyer's server decrypt and run your code while keeping the source sealed.

The security lesson carries over from the rest of Track A: never trust the client. Escrow hides your source, but it does not validate gameplay. If your resource lets a client say "give me $10,000," a cracker will. Keep every money mutation, item grant, and permission check on the server, using lib.callback to request data and the server to decide outcomes. Escrow protects your business; server-side validation protects the server you shipped to.

Sanctioned channels and the rules that bind them

This is the part people skip and then lose their account over. As of January 2026 there are exactly two sanctioned ways to sell FiveM assets:

1. Tebex — the long-standing storefront integration.
2. The Cfx Marketplace — added January 2026, run by Cfx.re directly.

Selling anywhere else — a Discord, a personal site, a sketchy forum — is a Platform License Agreement violation and a fast route to a ban. The rules are principles, not a checklist to memorize:

• No pay-to-win. You cannot sell gameplay advantages for real money.
• No real-money gambling or loot boxes. Random paid rewards are off-limits.
• No selling in-game currency for real money.
• No Rockstar or real-world IP. No GTA-brand assets, no real car logos, no copyrighted music.

These exist to keep FiveM a legal modding platform rather than a shadow casino. The list above is a snapshot — terms change. Always verify the current Cfx Platform License Agreement before you publish. Selling is simply how creators sustain the work; treat compliance as the cost of staying in business, not an afterthought.

Practice

You do not need FiveM to reason about escrow. Open the PlayDeck browser sandbox and paste this in:

local files = { 'config.lua', 'server/main.lua', 'locales/en.json', 'client/main.lua' }
local ignore = { ['config.lua'] = true, ['locales/en.json'] = true }

for _, f in ipairs(files) do
    print(f, ignore[f] and 'READABLE' or 'ENCRYPTED')
end

Run it. Now add 'client/main.lua' to ignore and re-run. Notice you just exposed your client source — a real mistake people make. Your task: change ignore so only configs and locales are readable, no matter how many script files you add to files.

Recap

• Shipping means portable, predictable, and one pinned framework.
• lua54 'yes' for the modern ox stack; escrow_ignore keeps configs and locales editable while escrow locks your logic.
• There is no manifest escrow key — protection happens at Keymaster upload. Verify any directive AI suggests against official docs.
• Escrow hides source; server-side validation protects gameplay. Never trust the client.
• Sell only via Tebex or the Cfx Marketplace (Jan 2026). No pay-to-win, gambling, currency sales, or Rockstar/real-world IP — and always re-check the current PLA.