s&box guide

s&box Server Admin Permissions and Troubleshooting

By the ChicagoServers team · Updated · 6 min read

Admins on an s&box dedicated server are defined in config/users.json, where each Steam ID gets a list of claims such as kick, ban or restart. Claims are just strings. What they actually allow depends on the game running on the server, because the game's code checks them.

This guide covers that permission model, how kicks and bans fit in, and fixes for the problems the official docs describe. Everything is from Facepunch's documentation as checked on 2026-11-01; where behavior depends on the game, it says so instead of guessing.

Quick answer
  • Edit config/users.json on the server and add your Steam ID with the claims you want.
  • Claims are plain strings. The host has all permissions by default, and a game checks a connection's claims with Connection.HasPermission.
  • Banning is done in game code (for example in AcceptConnection); the docs show no built-in ban list.
  • Server fails to start Steamworks? Link the Steam client binaries. "Not Connected"? The game has not created a lobby yet.
  • Use status on the server console for the lobby ID and connect LOBBYID in the client.
On this page
  1. How to make yourself admin: config/users.json
  2. What claims do
  3. Kicking and banning players
  4. Using the server console
  5. Common problems and fixes
  6. Test your setup before you open the server
  7. Updating the server and getting help
  8. Frequently asked questions
  9. References

How to make yourself admin: config/users.json

On the dedicated server, admins and per-player permissions are set in config/users.json. The default config demonstrates the format. It is a JSON list; each entry is a Steam ID, a list of claims and a name for your own reference.

config/users.json (format from the docs; use your own 17-digit Steam ID)
[
  {
    "SteamId": "00000000000000000",
    "Claims": [ "kick", "ban", "restart" ],
    "Name": "Example"
  }
]

Put one entry per person. Because the file is JSON, keep the commas and brackets valid. Restart the server after editing, since this is the safe way to be sure the new list is read.

What claims do

Claims are strings that describe actions a user may take. You can invent your own, because they are only strings. A game checks them by asking whether a connection has a permission, using Connection.HasPermission("name"). By default the host has all permissions.

  • Which claims exist is up to the game. kick, ban and restart in the default file are examples. If a game does not check them, adding them does nothing.
  • Permissions are not networked right now. Per the docs only the host can check whether a connection has a given permission.
  • Ask the game's author which claims it reads, or look in the game's description on sbox.game.

Kicking and banning players

The docs describe kicking and denying connections as something game code does, not a built-in server panel.

  • Kick: a host can remove a connection with channel.Kick("reason").
  • Turn someone away before they join: implement AcceptConnection. Return false and set the reason text the client sees. The docs example checks a list of banned Steam IDs and a full server.
  • Per-connection limits: the host can allow or deny spawning, refreshing and destroying networked objects per connection. Defaults are in Project Settings, Networking, and they can be overridden in the OnActive network event.

The practical consequence for a server owner: if you want bans that persist, choose a game that implements them, or have your developer add them. The official docs describe no ban list file for the dedicated server itself.

Using the server console

The one console command the docs show for the dedicated server is status, which displays the server's connection details including the lobby ID. Games can define additional commands (ConCmd) and variables (ConVar) of their own, and a command can be marked to always run on the server. Check the game's own documentation for what it offers.

The startup switches are console variables or commands run when the server boots, which is why +hostname and +port use the same + pattern as the game's own variables.

Common problems and fixes

ProblemCause and fix
Server cannot initialize SteamworksSteam client binaries are no longer shipped with the server. Install the Steam client, or on Windows set the SteamCMD registry entries, or on Linux symlink steamclient.so into ~/.steam/sdk64/. SteamCMD is required either way.
"Not Connected"No lobby has been created yet. The game's code has to create one, for example through the Network Helper's start-server option.
Players cannot connectGet the lobby ID with status, then run connect LOBBYID in the client console. Leave off the steamid: prefix.
Different Steam ID after every restartExpected without a token. Use +net_game_server_token with a token from Steam's game server management page to keep the same Steam ID.
Testing two clients on one PCUse +net_allow_local 1 on the server and connect local in clients on the same machine.
Staging server, players cannot joinThe staging branch might not be playable by everyone. Use the main branch for public servers.
Server-only code does not runCode in #if SERVER blocks and .Server.cs files runs only when the dedicated server is running a local project. It is stripped out of published games.

Test your setup before you open the server

A short test pass catches most admin mistakes before players find them. Everything here uses behavior the docs describe.

  1. Start the server on the main branch and wait until the game has created its lobby. Run status and confirm a lobby ID appears. If you see "Not Connected", fix that first.
  2. Join with your own account using connect LOBBYID. Use one account listed in config/users.json with only the claims you intend to give out, and a second account that is not listed.
  3. Try each claim in the game with both accounts, and confirm the game actually acts on it. If a listed claim changes nothing, the game does not read that claim.
  4. To test several clients on one PC, start the server with +net_allow_local 1 and join from the other instances with connect local.
  5. Restart the server, run status again, and make sure a player can rejoin using the new lobby ID.

Write down the exact launch line, the SteamCMD update command and the contents of users.json somewhere safe. When something breaks after an update, comparing against a known-good setup is faster than guessing.

Updating the server and getting help

Update with the same SteamCMD command you used to install: ./steamcmd +login anonymous +app_update 1892930 validate +quit. Back up config/users.json and your launch script first if you have customized them.

For bugs, Facepunch points players to the sbox-public issue tracker on GitHub and to their Discord. If you would rather have the server side handled for you, see s&box server hosting.

Frequently asked questions

Where do I set admins on an s&box dedicated server?

In config/users.json on the server. Add an entry with the person's Steam ID, a list of claims such as kick, ban and restart, and a name. What each claim allows depends on the game.

How do I ban someone on an s&box server?

The docs show bans as game code, for example checking a banned Steam ID list in AcceptConnection and refusing the connection. There is no documented built-in ban list, so use a game that implements bans.

Why do I get "Not Connected" on my s&box server?

A lobby has not been created yet. The game's code creates it, for instance through the Network Helper component's start-server option, so check that the game supports dedicated servers.

How do I update an s&box dedicated server?

Run the SteamCMD command again: ./steamcmd +login anonymous +app_update 1892930 validate +quit. Add -beta staging only if you want the staging branch.

References