FiveM escrow explained: what you can still edit

FiveM Asset Escrow is Cfx.re’s encryption for paid scripts: the protected files are unreadable, and the script starts only on a server whose license key belongs to the Cfx.re account that owns it. Every file the developer lists under escrow_ignore in fxmanifest.lua stays unencrypted, and you can still edit it on ESX, QBCore, Qbox or standalone. In our Dispatch System, those are the config, language, framework and editable files.

The manifests quoted here are from two of our scripts, Dispatch System and Jewelry Robbery.

How escrow works

1. The developer uploads the script to the Cfx.re Portal, which encrypts it. Escrow covers Lua, YFT, YDD and YDR files. It does not cover NUI, the in-game web interface: Cfx.re lists NUI as not supported, so those files are not encrypted.
2. The developer sells it as a Tebex package. Tebex checkout signs you in with your Cfx.re account. Your scripts appear in your Cfx.re Portal account.
3. You download the script and copy the whole folder to your server, including the .fxap file and every hidden file. Some FTP programs skip hidden or protected files, and a missing or damaged file can cause Failed to verify protected resource [resource name].
4. When the server starts the script, it checks the license key in sv_licenseKey against the account that owns the script. If that account does not own it, the script does not start and the console prints You lack the required entitlement to use [asset name]. The fix is in You lack the required entitlement.

Why it exists: Cfx.re’s Asset Escrow docs (read 19 October 2026) say it lets developers protect code “by preventing others from modifying or accessing” it. Its 2021 announcement adds that a script then runs only on the servers of the developer’s customers.

What escrow_ignore leaves open

escrow_ignore is a block in the script’s fxmanifest.lua. Every file it matches ships unencrypted. This is Cfx.re’s own example:

escrow_ignore {
  'script/code.lua',  -- Only ignore one file
  'stream/tuner.ydr', -- Works for any file, stream or code
  'stream/*.yft',     -- Ignore all .yft files in that folder
  'stream/**/*.yft'   -- Ignore all .yft files in any subfolder
}

For a developer: Cfx.re’s escrow FAQ still lists lua54 'yes' in the same manifest as a requirement for escrowed resources, although the manifest reference calls the setting deprecated.

For a server owner, three things follow:

• A file in the list is unencrypted. You can read it, change it and restart the script with your version.
• A file outside the list is encrypted. You cannot read or change it, so a change there comes from the developer as an update you download again from the Portal.
• Encrypted code can call functions that live in an open file. That is how a developer hands you the decisions: the encrypted part decides when to alert the police, and the open file decides which dispatch receives the alert.

What our scripts leave open

Every one of our scripts leaves its config files and editable files open. Newer scripts also open all framework code. This is the escrow_ignore block of Dispatch System (tk_dispatch):

escrow_ignore {
    'locales/*.lua',
    'config.lua',
    'config_sv.lua',
    'client/frameworks/*.lua',
    'server/frameworks/*.lua',
    'client/main_editable.lua',
    'server/main_editable.lua',
}

The product page puts it in one line: “Protected by Cfx.re Asset Escrow. The config files and editable files are open for you to change, including all framework-specific functions and events.”

Some scripts open fewer files. Jewelry Robbery (esx_tk_jewelryrobbery, ESX only) leaves this open:

escrow_ignore {
    'locales/*.lua',
    'config.lua',
    'client/main_editable.lua',
    'server/main_editable.lua',
}

In client/main_editable.lua, AlertPolice(coords) sends the robbery alert; with Config.Dispatch = 'tk' it calls exports.tk_dispatch:addCall, and you can replace the call with your own dispatch’s export. In server/main_editable.lua, CanStartRobbery decides whether a robbery may start (by default it checks only the cooldown), and RobberyStarted and RobberyFinished ship empty for your code. Its product page says: “Protected by Cfx.re Asset Escrow. The config files and editable files are open for you to change. To get something changed or added in the editable file, open a ticket on Discord.”

Wiring vehicle keys, phone numbers and billing through these functions is covered step by step in vehicle keys, dispatch and billing hooks.

Moving a script to another Cfx.re account

The purchase belongs to one Cfx.re account, so a server on a different account’s key cannot start it. You can move a purchased script yourself on the Portal. Cfx.re’s transfer article (edited 1 July 2026, read 19 October 2026) allows one transfer per asset, within 28 days of purchase, and a transfer cannot be reversed. TK Scripts makes no transfers on a buyer’s behalf.

Older answers that say “transfer it on Keymaster” mean the Portal: Cfx.re moved the Assets and Grants pages from Keymaster to the Portal on 15 October 2025.

Escrow on GTA V Enhanced

Cfx.re’s page What’s Changed in FiveM for GTAV Enhanced (read 19 October 2026) lists Asset Escrow under removed features as “Not implemented yet”. Read that page again before you plan an Enhanced server around paid scripts.

What to check before you buy an escrowed script

• The open files. Ask the seller which files are in escrow_ignore, or read the code access line on the product page. Config alone lets you tune a script; open framework and editable files let you connect it to your own inventory, phone, dispatch and framework.
• Your account. Buy with the Cfx.re account whose key your server runs on. A transfer is possible once, within 28 days.
• Paid or free. Free and paid FiveM scripts compares what open source and escrow each give you.
• Many scripts. If you want several of our scripts, start with the plans: one monthly subscription gives you a set of scripts. Scripts keep working until the end of the paid period, then stop.

After download, open the script’s fxmanifest.lua and find escrow_ignore. Every file it lists is unencrypted, so you can open and edit it; the rest is the encrypted core.