s&box Server Configuration

s&box has a surprisingly small surface area for configuration – three command-line switches, one JSON file, and two branch options. That's it. There's no server.cfg, no ConVar list, no gamemode.json. If a tutorial you've read claims otherwise, it's almost certainly repurposed from Source 1 or Garry's Mod and doesn't apply.

This guide covers the lot.

Command-line switches

These all go on the server's launch command line (Commandline Manager in the LOW.MS Control Panel).

+game <packageIdent> [mapPackageIdent]

The game package to load from sbox.game. Format is org.name, all lowercase, no spaces.

A few examples:

• +game facepunch.walker – Facepunch's first-party walker shooter.
• +game facepunch.walker garry.scenemap – walker on the garry.scenemap map.
• +game c:/projects/mygame/.sbproj – a local project file (for developers testing their own game).

The second arg is optional; without it the package's default map loads. If you're running a local .sbproj, connecting clients stream missing assets directly from the server – useful for iteration but slower than cloud-backed packages for everyday play.

+hostname <name>

Display name players see in the lobby list. Spaces are allowed. Keep it short – long names get truncated in most gamemode UIs.

+net_game_server_token <token>

A Steam-generated token that keeps your server's Steam ID consistent across restarts. Without it, every restart spawns a fresh server identity – any bookmarks or recent-server entries your players have will stop working.

Generate one at Steam's game server management page – pick "Create a new game server account", give it a short memo, and copy the token out. Drop it into your command line:

+net_game_server_token YOUR-TOKEN-HERE

Facepunch note this flag is optional and only becomes available at full release, not during the developer preview. If you're on a preview-era server it won't apply.

users/config.json – admin permissions

The single config file s&box actually documents. It's a JSON array of {SteamId, Claims} objects that grant specific admin capabilities to trusted players:

[
  {
    "SteamId": 76561198012345678,
    "Claims": ["kick", "ban", "restart"]
  },
  {
    "SteamId": 76561198087654321,
    "Claims": ["kick"]
  }
]

A few things worth knowing:

• Claims are arbitrary strings. kick, ban, and restart are the examples Facepunch document, but gamemode authors can define their own claims to gate specific features. Check the gamemode's docs.
• The server host has all claims implicitly. This file is only for granting partial admin to other players.
• Claims are server-side only. Clientside code cannot check what claims a player has, which means you shouldn't rely on them for UI affordances – only for server-enforced actions.

To edit: open Configuration Files in the panel, find users/config.json, and edit in place. No SFTP required. Save and restart the server to apply – claim checks happen at player connect time, not per-request, so a saved-but-not-restarted change won't take effect.

Steam IDs must be 64-bit integers, not SteamID3 or profile URLs. Convert at steamid.io if you've only got a player's vanity URL.

Branches: public vs staging

The server binary has two Steam branches.

public is the default. Stable, and what you want for anything players connect to. For 99% of operators this is the right choice.

staging is what Facepunch roll new changes into ahead of mainline. Occasionally breaks. Useful if you're specifically testing a gamemode against the upcoming server build. Set it via SteamCMD:

steamcmd +login anonymous +app_update 1892930 -beta staging validate +quit

In the panel, flip it via the branch-switch option on your service, or open a ticket and we'll switch it for you.

Don't run staging long-term on a server your players connect to. Its job is to surface breaks early, which is the opposite of what you want from a production-facing server.

What you can't configure

A few things people expect aren't options yet, because s&box is new:

• Tickrate / net_rate / cl_updaterate – no public ConVars for these. If a gamemode exposes networking config it'll do so internally, not via command line.
• Max players – enforced per-gamemode by the game package itself. Not a server-side setting.
• Map cycles – there's no built-in rotation. Some gamemodes implement their own rotation logic; most don't.
• RCON / remote console – no RCON protocol documented for s&box at time of writing. Use the panel's Web Console instead if you need live console access.

If any of these land later, Facepunch will announce via the official docs. Don't trust secondary blog posts that claim they exist today – several of them are just Source-1 material filed under s&box.

For the everyday usage path, Getting started with your s&box dedicated server is the shorter walkthrough. s&box server troubleshooting is where to head when something isn't working.