Palworld admin commands, RCON and the REST API explained

If you run a Palworld server, you quickly find out that the real work starts after the installation: moderating players, saving the world on time and scheduling restarts without half the community dropping out mid boss fight. Palworld gives you three tools for that: in-game admin commands, the old RCON protocol and the REST API. There is plenty of confusion online about the latter two, because a fair share of admin guides still points you to RCON — while the official server documentation has since declared RCON deprecated and announces that it will stop working in a future update. In this guide we lay out the current state of affairs, checked against the 1.0 syntax.

First: set the admin password

Everything starts with the admin password. Open PalWorldSettings.ini on your server and enter a strong password at AdminPassword:

AdminPassword="kies-iets-sterks"

Restart the server to load the change. Then open the chat in-game and log in as an administrator:

/AdminPassword kies-iets-sterks

From that moment on, the server accepts your admin commands. Take that password seriously: the same password will soon also be your access to the REST API, and anyone who knows it can take your server down. Still running an older version? Our knowledge base explains how to update your Palworld server to 1.0.

All in-game commands at a glance (1.0)

This is the complete official command set. You type them in the in-game chat after logging in with /AdminPassword:

You grab the Steam IDs you need for kicking, banning and teleporting with /ShowPlayers. Two practical tips: messages with spaces do not always come through cleanly, so use underscores if needed (/Broadcast Herstart_over_5_minuten). And save /DoExit for emergencies; for a normal stop, /Shutdown with a proper countdown is always the better choice.

Why is there no /give?

The most googled question among new admins: how do I give a player their items back after a crash, or how do I spawn a Pal? The honest answer: you cannot. On dedicated servers, Palworld has no /give, no spawn commands and no way to hand out XP or items. The official command set is purely server management tooling — moderating, saving, shutting down — not a cheat console like the one you may know from some other survival games.

If you still want to turn some knobs, there are two routes. World settings such as drop rates and XP multipliers can be adjusted in PalWorldSettings.ini; that is how you steer the entire economy of your server. And for actual item spawning there are mods, but those bring their own maintenance and crash risk. So do not promise your players compensation items after an accident: it simply is not possible with the tools the game gives you. A good backup schedule prevents more frustration than a give command ever would have.

RCON is officially deprecated

RCON is the classic remote console protocol you may know from other game servers. Palworld still supports it (on port 25575 by default, enabled with RCONEnabled=True), but the official server documentation is crystal clear about it: RCON is deprecated, use the REST API, and RCON is scheduled to stop working entirely in an upcoming update.

On top of that, Palworld's RCON implementation was never quite finished. It contains a known bug that mangles player names with multi-byte characters (think Japanese or Chinese names), which makes moderating by name unreliable. So the advice is simple: build nothing new on RCON, and if you have existing scripts or tools that lean on it, migrate them to the REST API before an update breaks them. If you come across a guide online that has you set up RCON at length, take a quick look at the publication date — chances are it was written before the REST API arrived.

The REST API: the new standard

The REST API is the official way to manage your server from outside the game. You enable it in PalWorldSettings.ini:

RESTAPIEnabled=True
RESTAPIPort=8212

After a restart, the API listens on port 8212 and uses HTTP Basic authentication: username admin, password your AdminPassword. All endpoints live under /v1/api/. A first test from the server itself:

curl -u admin:kies-iets-sterks http://localhost:8212/v1/api/info

You get JSON back with, among other things, the server version and name. The API can do everything the in-game commands can — announce (broadcast), kick, ban, unban, save and shutdown — but it also has three features that only exist through the API:

• /v1/api/settings — retrieve the active server settings;
• /v1/api/metrics — live server data such as frame rate, uptime and player count;
• the world actor snapshot — a snapshot of objects in the world, mainly interesting for external tools.

metrics in particular is worth its weight in gold: it lets you monitor the health of your server without logging into the game. A dropping server frame rate, for example, is the first signal that the well-known memory leak is acting up again.

Automating: saves and scheduled restarts

The big advantage of an HTTP API: anything that can call curl can manage your server. Two examples virtually every admin wants. First automatic saves, here every 30 minutes via cron:

*/30 * * * * curl -s -u admin:kies-iets-sterks -X POST http://127.0.0.1:8212/v1/api/save

And a clean restart: warn first, then shut down with a countdown. Your process manager (or the hosting panel) then starts the server again automatically:

curl -u admin:kies-iets-sterks -X POST http://127.0.0.1:8212/v1/api/announce \
  -H "Content-Type: application/json" \
  -d '{"message": "Server herstart over 5 minuten"}'

curl -u admin:kies-iets-sterks -X POST http://127.0.0.1:8212/v1/api/shutdown \
  -H "Content-Type: application/json" \
  -d '{"waittime": 300, "message": "Herstart over 5 minuten"}'

Note that the API messages handle spaces just fine. One important caveat to close with: never expose port 8212 to the internet. The API speaks plain HTTP and your admin password travels along with every request; the documentation itself says the API is not meant to be publicly reachable. Keep it on localhost or inside your own network and shield it with a firewall.

How it works in the MC-Node panel

If your server runs at MC-Node, you do not have to tinker with cron and curl yourself for day-to-day management. In the panel you edit PalWorldSettings.ini through the file manager (fill in the admin password, enable the REST API), follow the live logs and start, stop or restart the server with one click. Scheduled restarts and automatic backups are set up in the panel — and precisely with Palworld, with its notorious memory usage during long uptimes, you want those restarts enabled from day one. On top of that, the API stays fully available for anyone who wants to automate further or monitor externally.

No server of your own yet? In the Palworld store at MC-Node you start from € 6,00 per month, on our own hardware with NVMe storage in the Previder data center in Hengelo, with DDoS protection included and cancellable monthly.

Further reading

• Palworld server hosting: why you should schedule restarts
• PalWorldSettings.ini: the settings that actually matter
• Palworld memory leak: why your server keeps getting slower
• Awakening and Radiant Gems: how Palworld's new endgame works
• The best base locations in Palworld 1.0, by resource and playstyle