# Adding Admins & User Permissions on Your s&box Server (/docs/sbox/user-permissions)



import { Step, Steps } from 'fumadocs-ui/components/steps';

s\&box dedicated servers control who can do what through a **claims** system: each Steam account is assigned a list of permission strings (e.g. `kick`, `ban`, `restart`) in the `users/config.json` file. By default the host has every permission.

The users/config.json File [#the-usersconfigjson-file]

In your server install, edit `users/config.json` to grant permissions per Steam account. The default config shows the format:

```json
[

    /* You can give a Steam account specific permissions here using their Steam Id. */

    {
        "SteamId": "00000000000000000",
        "Claims": [ "kick", "ban", "restart" ],
        "Name": "Example"
    },

    {
        "SteamId": "00000000000000000",
        "Claims": [ "kick", "ban", "restart" ],
        "Name": "Example"
    }

]
```

| Field     | Description                                                                                                                          |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `SteamId` | The 17-digit SteamID64 of the user (e.g. `76561198xxxxxxxxx`).                                                                       |
| `Claims`  | Array of permission strings. Built-in examples: `kick`, `ban`, `restart`. You can also add **custom claims** — they're just strings. |
| `Name`    | Friendly label for your reference. Doesn't affect the user in-game.                                                                  |

Adding an Admin [#adding-an-admin]

<Steps>
  <Step>
    Stop Your Server [#stop-your-server]

    Open the [XGamingServer Panel](https://panel.xgamingserver.com) and **stop** your s\&box server. The config file is read at startup.
  </Step>

  <Step>
    Open the File Manager [#open-the-file-manager]

    In the panel sidebar click **Files**, navigate into the `users` folder, and open `config.json`.
  </Step>

  <Step>
    Find the User's SteamID64 [#find-the-users-steamid64]

    Get the player's 17-digit SteamID64 from [steamid.io](https://steamid.io) or by pasting their profile URL into [steamdb.info/calculator](https://steamdb.info/calculator/).
  </Step>

  <Step>
    Add an Entry [#add-an-entry]

    Add a new object to the array with the SteamID and the claims you want them to have:

    ```json
    {
        "SteamId": "76561198000000000",
        "Claims": [ "kick", "ban", "restart" ],
        "Name": "Server Admin"
    }
    ```

    Make sure to keep valid JSON — every object except the last needs a trailing comma.
  </Step>

  <Step>
    Save and Start [#save-and-start]

    Save the file and start the server. The new permissions take effect from the next boot.
  </Step>
</Steps>

Custom Claims [#custom-claims]

Claims are arbitrary strings, so a game running on your server can define its own. For example, a game might check for `economy.refund` or `world.edit` and the game's developer can add those claims to the array.

To check a permission in code:

```csharp
Connection.HasPermission( "kick" );
```

The host always returns `true` from this check.

Important Limitations [#important-limitations]

> ⚠️ **Permissions are not networked.** Only the **host** (the dedicated server itself) can check whether a connection has a permission. Clients cannot query each other's claims.

This means:

* Server-authoritative actions (kicking, banning, restarting) are safe to gate on claims.
* Don't use `HasPermission` on the client side expecting trustworthy results — always check on the server.

Related Guides [#related-guides]

* [Launch Parameters](/docs/sbox/launch-parameters)
* [Connect to Your Server](/docs/sbox/connect-to-your-server)
* [Server Token](/docs/sbox/server-token)