The Guide to Creating a Cyberpunk 2077 Server with Open77

To create a Cyberpunk 2077 server with Open77, you need alpha access, an open2077.net account with a verified email, a license key created in the keymaster, the dedicated server (Windows or Linux) and two open ports: UDP 11778 for the game and TCP 11779 for resources, by default. Cyberpunk 2077 isn't required on the host machine, but each player must own the game in version 2.31 with Phantom Liberty. Here is the complete procedure, from installation to showing up in the launcher.

Key takeaways

• Without a license key, the server doesn't enroll and doesn't appear in the launcher. The key is shown only once, when it is created.
• The server is self-contained: a Windows x64 or Linux x64 package with the .NET runtime included, no copy of the game on the machine, and shipped with the Freeroam mode ready to play.
• Warden, the web administration panel, listens locally on port 11780 and must never be exposed to the Internet.
• The project is in alpha: players need alpha access to join.

What you need before you start

• Alpha access to Open77, obtained from the official Discord.
• An open2077.net account with a verified email address, needed to create a license key.
• A Windows x64 or Linux x64 machine (Debian and compatible distributions). No separate .NET installation is needed.
• A machine sized for your resources: the documentation sets no minimum. As a guide, a VPS with 2 to 4 cores and 4 GB of RAM is enough to get started, to be increased depending on your Lua resources and player count. Your PC is fine for testing.
• An address reachable from the Internet: a domain name or a public IP, with the ability to open ports.
• On the player side: Cyberpunk 2077 version 2.31 with Phantom Liberty, on 64-bit Windows 10 or 11, and alpha access.

Step 1: get alpha access and create your account

Alpha access gives you the right to play, download the server and build game modes, with no separate developer application. Creating an account or downloading the launcher isn't enough to get it.

1. Join the official Discord and run the /alpha apply command in any channel.
2. Create your account on open2077.net with an email address and a password, then verify the email.
3. Once alpha access is activated on the account, use that same account on the site and in the launcher.

The details of the process are in the alpha access guide.

Step 2: download the official server

The server is downloaded from the site's Host page, reserved for alpha accounts. Windows gets a .zip archive, Linux a self-contained .tar.gz archive built for Debian and its derivatives. Each archive is published with its SHA-256 hash, to compare with the one of the downloaded file before running anything.

# Linux
sha256sum server-archive.tar.gz

# Windows (PowerShell)
Get-FileHash -Algorithm SHA256 server-archive.zip

Only download the server from the official page or its CDN. The stable build is offered by default and recommended. An "Unstable" build exists for testing: it unlocks after a warning, players must then choose Unstable in the launcher settings, and you should never overwrite a production server with a preview build. Always extract the new build into a separate folder, after backing up the configuration, resources and databases.

Step 3: create your license key

The license key ties the server to your account. It is used for enrollment with Open77's master server, for registration in the directory and for renewing the execution lease. Without a key, there is no enrollment and no listing: anonymous servers are not part of the platform.

1. Open the keymaster in your account, in the server license keys section.
2. Create a key with a label that identifies the server.
3. Copy it immediately. It looks like op77_live_ followed by 43 characters and is only shown once: the platform only keeps a hash and can never display it again.

An account can have twenty active keys. A single key can enroll several servers, but it's better to have one key per community or per environment (test, production): revoking a key immediately cuts off all the servers using it. The details are on the server licensing page.

Put the key in the OP77_LICENSE_KEY environment variable rather than in server.jsonc, so the file stays safe to share and back up.

# Linux
export OP77_LICENSE_KEY="op77_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Windows (PowerShell)
$env:OP77_LICENSE_KEY = "op77_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

These commands only apply to the current terminal. For a systemd service, a container or a hosting panel, define the variable in that service's environment. The first-launch wizard also accepts the key entered directly.

Step 4: first launch and the setup wizard

Extract the archive into a new folder, then run Start.cmd (Windows) or ./start.sh (Linux). You can also run Open77.Server.exe or ./Open77.Server directly.

If no server.jsonc file exists, the server opens a wizard in the browser, served locally by Warden on port 11780.

1. Open http://localhost:11780.
2. Enter the one-time PIN shown in the server logs.
3. Create the username and password of the owner administrator account. The PIN then becomes invalid.
4. Fill in the server name, the license key, the public address and the visibility. The wizard writes the server.jsonc file: review it before starting.

• To skip the wizard, place a valid server.jsonc next to the executable and launch with --no-setup.
• To reopen the wizard later, use --setup or --reconfigure.
• Leave the master server URL at its default value, https://master.open2077.net/. The local address shown for Warden is your administration panel, not the directory.

Step 5: configure server.jsonc

The file accepts JSON with // comments. Here are the blocks to know, as the wizard generates them.

{
  // How the server presents itself in the launcher and in the directory.
  "identity": {
    "name": "Neon District RP",
    "visibility": "public"
  },

  // UDP game port and the address players use.
  // Never a local network address.
  "network": {
    "port": 11778,
    "publicEndpoint": "play.example.com:11778"
  },

  // Server information, queryable from outside.
  "query": {
    "enabled": true,
    "map": "Night City",
    "gamemode": "Freeroam"
  },

  // The link with the platform. Leave enabled set to true.
  "masterServer": {
    "enabled": true,
    "url": "https://master.open2077.net/",
    "licenseKey": null,
    "licenseKeyEnvironmentVariable": "OP77_LICENSE_KEY"
  },

  // Administration panel, keep it local.
  "warden": {
    "enabled": true,
    "bind": "127.0.0.1:11780"
  }
}

• identity.name: the name displayed in the launcher and on the public list. It's the server's storefront.
• identity.visibility: public to be listed, unlisted or private for an invite-only server, enrolled and licensed but kept off the public list.
• network.port and network.publicEndpoint: the UDP game port (11778 by default, changeable with network.port or --port) and the address given to players. It must be reachable from the Internet, so not a 192.168.x address.
• query: enables querying of server information and sets the advertised map and game mode. Leave it enabled if you want a directory to be able to pull the server's statistics.
• masterServer: registration with the master server. Leave licenseKey at null to read the key from the environment variable.
• warden.bind: the panel's listening address, to keep local.

Other fields can be set in the same file or as startup options, such as network.maximumPlayers, identity.description and identity.tags. The official hosting page details the basic fields.

Step 6: open the ports and validate the configuration

Players must be able to reach both the game and the resource download server. The server never modifies the firewall: rules and NAT or container redirections are configured separately.

Here are example firewall rules for the two public ports:

# Windows (PowerShell, as administrator)
New-NetFirewallRule -DisplayName "Open77 Game" -Direction Inbound -Protocol UDP -LocalPort 11778 -Action Allow
New-NetFirewallRule -DisplayName "Open77 Downloads" -Direction Inbound -Protocol TCP -LocalPort 11779 -Action Allow

# Linux (UFW)
sudo ufw allow 11778/udp
sudo ufw allow 11779/tcp

# Linux (iptables)
sudo iptables -A INPUT -p udp --dport 11778 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 11779 -j ACCEPT

Behind a home router, forward UDP port 11778 and TCP port 11779 to the machine's local IP, then give your public IP with --public-ip or in network.publicEndpoint. Without that, players see the server but can't connect to it.

On a VPS, the --public-ip option automatically fills in the game's public address and the download addresses from the IP provided by the host. The server doesn't discover its own public IP.

./Open77.Server --no-setup --config server.jsonc \
  --public-ip 200.0.100.10 --port 11778 --max-players 32 \
  --log-level info

Replace 200.0.100.10 with your machine's real IP. These overrides require a server version 2.31.13+op77.91 or newer. They apply to the running process without rewriting server.jsonc, and the precedence is: defaults, file, OP77_CONFIG__... variables, then command-line options.

Before starting for real, add --check-config to the same command. Exit code 0 confirms the configuration is valid, while code 2 flags a configuration or argument error with the field concerned. This test opens no port, doesn't contact the master server and doesn't check reachability from outside.

Keep secrets off the command line, where process lists or panel logs can expose them. The startup arguments and logging page lists all the options.

Step 7: start the server and check that it shows up

Start the server with the OP77_LICENSE_KEY variable set. On startup, it presents the key to the master server, which verifies it, ties the server to your account and issues an execution lease renewed at every heartbeat. Shortly afterwards, the server appears in the launcher and on the public list, under your account, and players can join it. Stop it or revoke its key, and it disappears just as automatically.

If it doesn't appear, check in order:

1. the license: an unknown or revoked key, or a suspended owner, produces the message "Master refused the platform license key" in the logs;
2. the visibility: a private or unlisted server isn't published;
3. the connection to the master server;
4. the public address: local network and loopback addresses are never listed.

To test before being listed, the launcher offers direct connection with a hostname or an IP and a port. It bypasses neither alpha account approval nor the server's rules. Service status can be followed on the status page.

Our take

For a first try, don't open to the public right away. Start the server with the Freeroam mode shipped in the package, with private visibility or a whitelist, and test with two or three friends who have alpha access. The alpha warns of bugs, crashes and API changes: better to discover them among friends than in front of a community. When the server holds up, go public and take care over the name and description. Most listing failures come from a misconfigured key, address or port, not from the game.

Step 8: administer the server with Warden

Warden is the web administration panel built into the server, the role txAdmin plays for FiveM. It listens locally on port 11780. The first-launch wizard generates a server.jsonc that enables it with the block below. If you write the file by hand, add this block yourself: Warden stays disabled as long as warden.enabled isn't set to true, and the server must be restarted.

{
  "warden": {
    "enabled": true,
    "bind": "127.0.0.1:11780"
  }
}

Log in at http://localhost:11780 with the owner account created in step 4. Warden gives access to:

• the live console, to read logs and enter server commands;
• hot reloading of Lua resources, without a restart or disconnecting players;
• moderation: warn, kick or ban a player, and manage the ban list;
• announcements sent to all players, for example a restart warning;
• the server's configuration and identity (name, visibility, public presentation), without editing files by hand;
• roles, to give each staff member limited access.

Create one Warden account per administrator, with only the rights they need, rather than sharing the owner account: you keep track of who does what.

Warden gives full control of the server. Keep it on localhost, or behind a VPN or an SSH tunnel, without exposing its port to the Internet. For a remote server, a standard SSH tunnel is enough:

ssh -L 11780:127.0.0.1:11780 user@server-address

The panel then opens at http://localhost:11780 from your computer. The Warden page details the roles and the operations that require a restart.

Step 9: control who can join

The server keeps its own access list in the access.json file, next to server.jsonc: a whitelist and a ban list, indexed by account identifier (userId). It applies before any Lua resource, including for direct connections. Warden, the console and the Lua API edit the same list.

whitelist                          status and listed identities
whitelist.on | whitelist.off
whitelist.add <userId> [label]
whitelist.remove <userId>
bans                               active bans
ban.id <userId> [seconds|0] [reason]
unban <userId>

Turning the whitelist on immediately disconnects all unlisted players, including staff and your own game account. Add those identities first. A player finds their identifier with the identity.dump command in the client console, and an administrator can also read it in the refusals logged by the server. Always ban on the identifier, never on the username, which the player can change.

The server license doesn't replace these rules: it handles enrollment, the directory and the execution lease, not player admission. The connection control page also describes the Lua gates, with examples of whitelists and expiring bans.

Step 10: choose and add resources

The game content of an Open77 server is made of resources: folders containing a manifest, server and client Lua scripts, declared permissions and, if needed, web interfaces. The server package includes the Freeroam mode (races, PvP, wardrobe, animation menu) and system resources such as chat, voice, weather and administration.

The resources.load array in server.jsonc chooses which resources are loaded. An exact list is recommended in production, so a development resource added to the library doesn't end up on a live server.

"resources": {
  "enabled": true,
  "root": "../resources",
  "load": [
    "open77_shell",
    "open77_chat",
    "open77_vehicles",
    "freeroam",
    "open77_freeroam"
  ],
  "autoStart": true
}

The first-launch wizard already writes an exact list for the shipped template: start from that one rather than rewriting it by hand.

Resource folders are organized by category:

resources/
  system/       official platform resources
  gamemodes/    game modes and their HUDs (freeroam, race, pursuit...)
  dev/          examples and test benches
  assets/
    loaders/    loaders (archivexl, tweakxl)
    maps/       world packages
    vehicles/   vehicle packages
    mods/       other third-party packages

A minimal resource fits in one manifest and one script. Server scripts are never sent to players.

-- resources/hello/open77.lua
resource "hello"
version "1.0.0"
auto_start true

client_script "client/main.lua"
server_script "server/main.lua"

permissions { "network.events", "world.loot" }

-- resources/hello/server/main.lua
RegisterCommand("hello", function(source, args)
    print(("player %d said hello"):format(source))
end, false)

To add a resource to a running server: create its folder, add its name to resources.load, then restart the server, or run refresh followed by ensure name if the name was already in the list at startup. server.jsonc isn't re-read live: a name missing from the list at startup requires a restart, and ensure then answers that the resource can't be found. With autoStart on, a valid resource change is detected, published as a new signed bundle and sent to players, who only download the missing pieces. The resources, start, stop, restart and reload commands round out the console.

To go further, the documentation covers the resource model and the Lua API reference.

Coming from FiveM?

Open77 borrows several FiveM concepts: client and server separation, events, exports, commands and a manifest-driven lifecycle. FiveM compatibility aliases exist (the Citizen table, SetTick, promise.new, shared script helpers), and a ported manifest accepts FiveM keys such as fx_version or game, which are ignored. fxmanifest.lua becomes open77.lua.

However, GTA V natives (such as Citizen.InvokeNative, RequestModel or RequestAnimDict) don't exist on the Cyberpunk side: a FiveM script must be adapted to the Open77 API, not simply copied. Including files between resources with @other_resource/file.lua is also rejected, so you need to go through dependencies, require and exports.

Step 11: require mods for your world (optional)

Before going the mod route, check that the content can't be done as a Lua resource. Props, markers, zones, courses or interiors furnished from elements already in the game ship with no download or restart, with hot reload. A mod is only needed for elements the game doesn't contain, such as new buildings or vehicles (.archive archives and .xl files). Custom map geometry remains experimental.

When a mod is needed, the server declares it and hosts it itself, and the launcher installs it when the player clicks Connect, before the game launches: the player doesn't have to restart. The flow goes through Warden.

1. Open Warden's Mods tab. It requires the mods.manage permission.
2. Drop in the mod archive (Zip, 7z or RAR). Nothing is written at this stage: you get a plan.
3. Review the plan: for each file, its destination, whether it is inert or executable, whether it adds or replaces a game file, and its SHA-256. This is the only moment you see the content before your players do.
4. Confirm, then restart the server: the fingerprint of the required mod set changes, and that is what each launcher compares.

Warden itself writes the requiredMods block in server.jsonc, up to 64 packages. An indexed entry (a package the platform already distributes, such as ArchiveXL) looks like this:

"requiredMods": {
  "enabled": true,
  "packages": [
    { "id": "archivexl", "minVersion": "1.27.1" }
  ]
}

A hosted entry (your own bytes, served by your server) additionally requires sha256, version and sizeBytes. Each package receives a status that decides what it is allowed to contain:

• Verified: the exact bytes have been reviewed by the Open77 team, any content type is allowed, including executable.
• Unverified: supplied by your world without review. Only inert data is accepted (.archive, .tweak, .xl, INI files under engine/config). The player is warned before anything is written and can decline.
• Blocked: rejected, and the connection is refused with the reason named.

Executable content (.dll, .reds, CET scripts, .asi) is rejected until those exact bytes are verified. Warden lets you request a review, but the turnaround isn't guaranteed: don't plan a launch around it. There is no player-side setting to lift this limit.

The requiredMods.unsecured mode lifts this ceiling for a single server. The server then receives an UNSECURED badge and a red warning in the server browser, and players must confirm before joining. Reserve it for a private or trusted community, not a public server.

Keep in mind that you are the host of the hosted packages: each new player downloads the whole set from your server, and the bandwidth is on you. To remove a mod, delete its entry in Warden then restart: players have nothing to uninstall. The full guide is the server-required mods page, and the mods and custom resources page describes the player side.

Option: connect a MySQL or MariaDB database

The SQL bridge is disabled by default. It only handles MySQL and MariaDB, with no PostgreSQL, SQLite or SQL Server, and no oxmysql resource is needed. Create a dedicated database and account, with rights limited to that database, then add this block to server.jsonc.

{
  "database": {
    "enabled": true,
    "connectionString": "",
    "connectionStringEnvironmentVariable": "OP77_DATABASE_CONNECTION",
    "maxRows": 10000
  }
}

The connection string is supplied through the OP77_DATABASE_CONNECTION variable, in MySqlConnector format (semicolon-separated values), and not as a mysql:// URL.

Server=127.0.0.1;Port=3306;Database=open77;User ID=open77;Password=SECRET;

Restart the server after any change. Players never need to reach port 3306, which must not be opened to the Internet for a local database. Each resource that accesses the database must declare the database.access permission, and all of them share the same database and the same SQL account: only grant this permission to resources you have reviewed. A copy of the resources/ folder doesn't back up the SQL data. The SQL configuration page details the check from Lua and troubleshooting.

Our advice

Keep the license key in the environment, never in a shared file or in a command-line option. Use one key per server so you can revoke one without cutting off the others. Back up server.jsonc, access.json, your resources, the database and the resource signing key file together (.open77/resource-signing-key.json in the documentation's example), because the server must keep that key during a migration. Never commit it, and automate these backups: a manual copy always ends up forgotten. Run --check-config before every production restart, and keep Warden local.

Getting your server noticed on Private Server

Once the server is stable and open to the public, visibility comes from players looking for a Cyberpunk 2077 community. Our Cyberpunk 2077 server listing brings community servers together in one place, for players who want to know where to play.

Before listing yours, prepare what a player wants to know before joining:

• A clear name and a description that states the game mode (roleplay, racing, freeroam, PvP), the language and the atmosphere.
• Your main rules and a way to contact the team.
• Your Discord, where players ask questions and follow announcements.
• How to join: the direct connection link open77://connect?server=identifier, where the identifier is the public identifier assigned by the master server and not the connection address, which can change. This link bypasses neither the ticketing nor your access rules, and it does nothing if the player doesn't have the launcher: add a sentence of explanation next to it.
• Player-side requirements: Cyberpunk 2077 version 2.31, Phantom Liberty, the launcher and alpha access. A player who doesn't know them mistakes a working server for a broken one.

The full operation of the direct link is described on the your server in the launcher page.

Troubleshooting: common symptoms

• The server doesn't appear in the launcher: check the license, the public visibility, the connection to the master server and a reachable public address.
• Players see the server but can't connect: a port forward or a public IP is missing, especially behind a home router. Check UDP 11778 and TCP 11779.
• It's listed but downloads fail: test the public download URL and the associated TCP port from outside.
• Changes made in Warden disappear on restart: a startup option or an environment variable is still overriding the same field.
• No resource messages in the Warden console: the warn and error log levels hide informational messages. Switch to info or debug, then go back to info once the test is over.
• A player is rejected: check their alpha access, their game version (exactly 2.31), their copy of Phantom Liberty and the server's whitelist.

Frequently Asked Questions

Do you need to own Cyberpunk 2077 on the server machine?

No. The dedicated server runs independently of the game, REDengine and the client plugin, and never loads game content. It exists for Windows x64 and Linux x64 (Debian and compatible distributions), with the .NET runtime included. However, each player must own Cyberpunk 2077 version 2.31 with Phantom Liberty, on 64-bit Windows 10 or 11.

How much does hosting an Open77 server cost?

The platform is meant to be free. Players buy the game and the expansion, and server owners pay for their own hosting, which costs nothing extra if you host on your own machine. The documentation sets no minimum configuration: as a guide, a VPS with 2 to 4 cores and 4 GB of RAM is enough to get started.

Which ports do you need to open?

UDP port 11778 for game traffic and TCP port 11779 for resource downloads, by default. Warden's port 11780 stays local, and port 3306 of a local database must not be exposed.

Do my FiveM scripts work on Open77?

Partly. Open77 offers compatibility aliases (threads, commands, events, exports) and fxmanifest.lua becomes open77.lua. But anything that depends on GTA V natives must be rewritten with the Open77 API, which describes Cyberpunk 2077's entities.

How many players can a server hold?

No ceiling is guaranteed: capacity depends on the hardware, the loaded resources and the load. You set the maximum with network.maximumPlayers or the --max-players option (the documentation gives 32 as an example).

What should you do if the license key is lost or leaked?

The key is only shown once and the platform can't recover it. Revoke it in the keymaster and create a new one. Revocation immediately cuts off all servers enrolled with that key, hence the value of one key per server.

Can you keep a private server among friends?

Yes. With private visibility, the server stays enrolled and licensed but doesn't appear in the public list. Your friends connect to it with the launcher's direct connection (hostname or IP and port), as long as they have alpha access. Add a whitelist to lock down access.