Cfx escrow explained: what you can edit, what you cannot, and why the licence check fails

Cfx escrow is the reason a paid RedM script arrives with half its files unreadable and a licence error waiting for anyone who copies it to a second server. It protects the author, and done properly it costs you nothing. Done badly it locks you out of your own config. This is how it works from the buying side, what a good escrowed script leaves open, and what to check when the server refuses to load one.

What escrow does

When an author uploads a resource to the Cfx.re portal with escrow on, the portal encrypts its Lua files. Each buyer then downloads a build that carries a small .fxap file: a licence tied to the buyer's Cfx.re account. At start, the server checks its own licence key against that file and decrypts the protected files in memory. The code never sits readable on your disk, and a build copied to a server with a different key does not run.

Two consequences worth knowing. Escrow protects Lua only; HTML, CSS, JavaScript, images and SQL files are always readable. And the encryption is per upload: a new version from the author is a new build, downloaded again from Tebex, unless the script has its own way of updating.

What a good escrowed script leaves open

Authors choose which Lua files stay readable with an escrow_ignore list in fxmanifest.lua. On a script made for server owners rather than against them, that list holds:

• config.lua, or the whole config/ folder. Job names, locations, prices and commands have to be yours to change.
• Translation files, so you can run the script in your language.
• Anything you are meant to ship inside your own resources. Poggy AnimTool ($24.99) exports scenes that play through a runtime file you copy into your own scripts; that runtime is left out of escrow because an encrypted copy would be useless to you.
• Often the interface: Auction House ($29.99) and Poggy Markets ($99) leave the HTML, CSS and JavaScript editable so you can restyle them.

Every product page in this store says what is open under "Open where it matters". If a script you are considering elsewhere does not say, ask before buying; a config you cannot edit is a script you cannot fit to your server.

What you cannot do

• Read or change the encrypted files. Not with a text editor, not with a decompiler; the server decrypts them in memory and nowhere else.
• Run the build on a server whose key belongs to another Cfx.re account. This is the whole point.
• Rename the resource folder on some scripts. Scripts that refer to themselves by folder name break when renamed; scripts written with GetCurrentResourceName() do not. Poggy scripts identify themselves by a fixed id, so the folder can be called anything.

The licence error, and the three causes

An escrow error at start looks alarming and is never a config problem. In order of likelihood:

1. Account mismatch. The server's licence key is registered to a different Cfx.re account from the one you used at Tebex checkout. Check both at portal.cfx.re. Buying on a second account, or a developer who bought under theirs, is the usual story.
2. The purchase has not reached Keymaster yet. Tebex tells Cfx about the purchase; occasionally that takes a few minutes. Restart once more before you open a ticket.
3. A stale or missing .fxap. A build copied from another machine, or restored from a backup that excluded the file. Download it again from your Tebex purchases and the file comes with it.

Escrow and updates

The part that wears people down is that every update to an escrowed script is a new portal build: re-download from Tebex, unzip, keep your config, restart, for every script, every release. The reason is that only your account can fetch a build with your .fxap.

The way around it is an update system that fetches the new build itself and leaves the licence file alone. That is what Poggy Core (Free) does: it downloads the new escrowed build from the update feed, merges your config, backs up what it replaced, and never downloads, compares, writes or deletes a .fxap. The licence you already have unlocks the newer build, so an escrowed script updates in place while the server runs. Witnesses (from $6.99/mo) and every other Poggy script, paid or free, update this way.

Buying escrowed scripts sensibly

• Buy with the Cfx.re account that owns the server key, or link the developer's purchases to it before launch.
• Before paying, read what is open. Config and translations at minimum.
• Back up the .fxap files with the rest of the resource folder; see how to back up a RedM server.
• Prefer scripts that identify themselves by id rather than folder, and that update without a portal trip. The time it saves is measured in evenings.