Configuring admin permissions on S&Box (users/config.json)

Introduction

No groups, no automatic hierarchy: S&Box manages permissions via a single JSON file (users/config.json) where each admin is listed by SteamID64 with a list of "claims". The host (you, the server owner) implicitly has all rights. The system is deliberately minimal and delegating: gamemodes can define their own claims.

Prerequisites

• An active S&Box server at VeryCloud
• The SteamID64 of admins to add (format 7656119xxxxxxxxxx)
• Access to the Wisp Files manager

Step 1: Retrieve a SteamID64

Several methods to convert a Steam profile to SteamID64:

• Go to https://steamid.io/ and paste the Steam profile URL
• Or use a converter from vanity URL → SteamID3 → SteamID64

Expected format: 17 digits starting with 7656119. Example: 76561198012345678.

💡 Make sure to wrap the SteamID64 in quotes in the JSON — it's a string (the parser refuses numbers).

Step 2: Locate users/config.json

In the Wisp panel:

1. Open Files
2. Navigate to the users/ folder
3. If config.json doesn't exist, create it

Typical path: /home/container/users/config.json

Step 3: File structure

{
  "Users": [
    {
      "SteamId": "76561198012345678",
      "Name": "MathysAdmin",
      "Claims": [ "kick", "ban", "restart" ]
    },
    {
      "SteamId": "76561198098765432",
      "Name": "NightMod",
      "Claims": [ "kick" ]
    }
  ]
}

• SteamId: SteamID64 in quotes (string)
• Name: free label for your own reference (server doesn't use it)
• Claims: list of strings, see next step

Step 4: Standard claims documented by Facepunch

The host has all claims implicitly, so you don't need to add yourself to this file (unless you want to revoke your own claims).

Step 5: Custom claims (defined by the gamemode)

Claims are arbitrary strings. An RP gamemode can define its own claims to gate features:

"Claims": [ "kick", "ban", "rp.giveitem", "rp.teleport", "rp.spectate" ]

The gamemode checks these claims server-side via Connection.HasPermission("rp.giveitem"). The gamemode's docs (or your C# code if you're building your own) should give you the available claims list.

⚠️ Claims are not networked: a client can't check their own claims to show/hide a UI button. Don't rely on them for display, only for server actions.

Step 6: Apply changes

users/config.json is read at server startup and on hot modifications in some implementations. To be safe:

1. Save the file
2. Restart the server from the panel Console
3. Verify no JSON parsing errors in the console

Step 7: Test permissions

After restart, ask the admin to test their claims:

• Try kicking a player (gamemode command, e.g. /kick <player>)
• Attempt an unauthorized command — it should fail cleanly

If nothing works, check the server console for permission errors.

Troubleshooting

Failed to parse users/config.json

• The JSON has a trailing comma or missing brace
• Use https://jsonlint.com/ to validate syntax
• SteamID must be string (quotes), not number

The admin has no rights

• Correct SteamID64? (not SteamID3 [U:1:xxxxx])
• The claim used matches what the gamemode expects?
• Was the server restarted after the change?

Changes aren't applied

• Force a full restart via Console → RESTART
• If still not applied, verify the file is at users/ in the container root

Useful commands

# Validate JSON via CLI (if you have shell)
cat users/config.json | python3 -m json.tool

# Convert SteamID via curl + API (needs Steam API key)
# Easier: use steamid.io

Conclusion

The S&Box permission system is minimal and clean: one JSON file, claims, host has all rights. For complex structures (mods, senior mods, admins, superadmins), the gamemode must handle hierarchy by defining its own claims.

Going further: create custom claims for your C# gamemode, integrate with an external admin web panel, log admin actions to Discord.

Resources

• S&Box Docs — Server Permissions
• SteamID conversion tool
• Steam Web API — ResolveVanityURL
• JSON Validator