Palworld's admin commands are typed in the game's chat once you have used /AdminPassword, and the same jobs can be done from outside the game through the server's REST API. RCON, the older remote route, is deprecated: Pocketpair says it "is scheduled to stop functioning in an upcoming update." This page lists every command, the REST API that replaces RCON, and what each one did on a Palworld 1.0.5 server we ran for the test.
Get admin rights on your server
- Set
AdminPasswordin the server's PalWorldSettings.ini (the Palworld server settings generator builds the whole settings line for you; on a rented server it is usually a field in the control panel). Pocketpair: "The AdminPassword must be set in the configuration file beforehand in order to execute the command." - Join the server, press Enter to open chat and type
/AdminPasswordfollowed by that password. Pocketpair: "To execute a command from within the game, press Enter and type the command." - Then run the commands below in chat, with the leading slash, such as
/Save.
The admin password is not the join password. ServerPassword is what friends type to get in; AdminPassword unlocks commands, RCON and the REST API.
Every admin command
The list is Pocketpair's, for version 1.0.4 of its server guide. The last column is what the server told us when we sent each command from outside the game, through RCON and through the REST API, on version 1.0.5.102999 with no player online.
| Command | What it does (Pocketpair) | What we saw |
|---|---|---|
/AdminPassword <password> | Obtain administrative privileges using a password. | In-game only. |
/ShowPlayers | Show information on all connected players. | |
/Info | Show server information. | |
/Save | Save the world data. | Both routes rewrote the world's Level.sav. |
/Broadcast <MessageText> | Send message to all player in the server. | Through RCON only the first word goes out: Broadcast Server restart in 5 minutes is answered Broadcasted: Server, even in quotes. The REST API's announce takes the whole message. |
/KickPlayer <SteamID> | Kick player <SteamID> from the server. | Only for a player who is online: for an id that was not, RCON answered Failed to Kick and the REST API 400 Bad Request. |
/BanPlayer <SteamID> | Ban player <SteamID> from the server. | Works on a player who is not online. The id is written to Pal/Saved/SaveGames/banlist.txt. |
/UnBanPlayer <SteamID> | Unban player <SteamID> from the server. | Removes the id from banlist.txt. |
/Shutdown [Seconds] [MessageText] | Shutdown the server. If [Seconds] is specified, the server will shut down after the specified time has elapsed. | The server left about that many seconds later and saved the world on the way out. |
/DoExit | Force stop the server. | The server process ended at once. |
/TeleportToPlayer <SteamID> | Teleport to <SteamID>. | Not sent from outside the game. |
/ToggleSpectate | Switch to spectator mode (admins only). | In-game only; not tested. |
Which player id to use
Pocketpair's table writes the argument as <SteamID>, but crossplay brought other platforms, and each player has a user id of their own. The REST API's player list shows it as userId, in the form steam_ followed by digits for Steam players; on a ForgeWorld Gaming Palworld server, PS5 players' ids start with ps5_. That user id is what KickPlayer, BanPlayer and UnBanPlayer take: our server accepted a ps5_ id for a ban and wrote it unchanged at the start of a banlist.txt line, followed by a comma and a 32-character player id. The playerId in the same list is a different, 32-character id.
RCON is deprecated
RCON lets an outside program send the commands above without joining the game. It is switched on with RCONEnabled=True and listens on RCONPort. Pocketpair's guide has marked it deprecated since version 0.5.0 and now adds that it "is scheduled to stop functioning in an upcoming update." Two limits already show:
- Broadcast loses everything after the first word, as in the table. Underscores or hyphens instead of spaces get a message through:
Broadcast Server_restart_in_5_minutesarrived whole. - Names with multi-byte characters break. Pocketpair: "if a player's name contains multi-byte characters (letters), the letters following these will be missing", and for those it points to the REST API.
Anything you run on RCON today, such as a restart warning script or a Discord bot, should move to the REST API before the update that turns RCON off.
The REST API
Pocketpair's server guide has documented the REST API. It is off by default (RESTAPIEnabled=False in a new PalWorldSettings.ini) and listens on RESTAPIPort, 8212 by default. Turn it on with RESTAPIEnabled=True while the server is stopped, then start it.
Keep it private. Pocketpair: "These APIs are not designed to be exposed directly to the Internet. Publishing directly to the Internet may result in unauthorized manipulation of the server," and "It is recommended that they be used within the LAN." Do not forward port 8212 on your router.
Three things we ran into while testing:
- A POST without a body needs
Content-Length: 0. Without it the server refused/savewith HTTP 411 (missing_content_length_header), and its reply was often malformed, so curl sometimes reportedReceived HTTP/0.9 when not allowedinstead. With an empty body or that header, the same request returned 200 every time. - A kick for a player who is not online answers 400
Bad Request. - The server logs every call, which is a quick way to see whether a request arrived.
Shutdown, DoExit and Save
Shutdown with a number of seconds counts down, then saves and exits: on our test server the world file was rewritten during the shutdown. DoExit ("Force stop the server") ends it at once, so run Save first if you can.
On a hosted server, stop it with the control panel's Stop button rather than these commands. A panel that manages the server process usually treats an exit it did not ask for as a crash: on ours, after a Shutdown or DoExit typed in the Console the panel started the server again by itself, while Stop kept it off.
Where ForgeWorld Gaming fits
On a ForgeWorld Gaming Palworld server you send these from the control panel's Console tab, without joining the game or typing the admin password: enter the command without the slash, such as Save or ShowPlayers. Since 22 October 2026 the Console sends them through the REST API, which the panel turns on inside your server and which is not open to the internet; a server that was already running then switches over at its next restart.
Broadcastsends your whole message, accents included.ShowPlayersanswers, andInfo,MetricsandSettingsshow the server's version, performance and running settings.KickPlayer,BanPlayerandUnBanPlayertake the player's user id, with an optional message after it for a kick or ban.- The Stop button sends
shutdown 15, so players get 15 seconds and the world is saved on the way out. If you press Stop in the first moments after the server shows as running, before the game takes commands, the console holds it instead of losing it. - Commands the REST API does not cover still go over RCON. Type
helpto see the list.
A Shutdown or DoExit typed in the Console ends the server, and the panel then starts it again by itself, so use Stop when you want it off. Until a server that was running before 22 October 2026 restarts, its Console still uses RCON, so Broadcast sends only the first word; join the words with underscores.
We proved this on 22 October 2026 on throwaway Palworld servers on our own panel, version 1.0.5.102999. Broadcast, Save, Info, ShowPlayers, Metrics, Settings, KickPlayer, BanPlayer, UnBanPlayer and Shutdown all went through the REST API from the Console tab (a DoExit ended the server at once and the panel started it again), Broadcast Server restart in 5 minutes went out whole, Save rewrote the world file, a ban reached banlist.txt and the unban removed it. Stop took about 20 seconds and saved the world, and Stop pressed the moment the panel showed the server running still stopped it. With the REST API switched off, the same Console fell back to RCON. A new server created from the panel's current Palworld template came up with the REST API on and the same Console. No game client joined, so we saw the server accept each broadcast, not the message on a player's screen.
Prefer renting to keeping your own server machine online? ForgeWorld Gaming currently offers Palworld Standard: 4, 8 player slots at CA$23.99–CA$33.99/month. Hosted in Iowa, United States. Prices are in Canadian dollars, with no setup fee and cancel any time. Your server is set up automatically after payment. Continue to secure billing, Palworld · Dedicated server, CA$23.99 / month (Standard, 4 slots), or compare Palworld plans.