Use Palworld administration without exposing RCON publicly
Palworld administration can save or stop the world and remove players. Protect it separately from ordinary joining. Current Pocketpair documentation marks RCON as deprecated and scheduled to stop working in a future update, so a new administration setup should not depend on legacy RCON remaining available.
Separate the two passwords
The server join password admits players; the administrator password grants privileged operations. Use different, unique values. Keep the administrator value restricted to trusted maintainers and store it in a password manager. Do not publish it in a server description, joining instructions or a screenshot of the full configuration.
Back up the active configuration before changing credentials. Stop normally, change the supported setting through the installation’s configuration method, then restart during an announced window. Make sure you edited the active file rather than the default example. Do not ask a player to send their private account password to obtain server administration.
Verify in-game administration
Pocketpair documents /AdminPassword for obtaining administrator privileges after the server administrator password is configured. Enter the value privately in game using the documented command for the installed release. Avoid broadcasting it through a public chat bridge or recording the entry on stream. Test a harmless information operation before using commands that affect players or the world.
In-game access is sufficient for many occasional tasks. A separate remote-control listener is unnecessary just because an older guide includes one. Check the current command reference rather than copying a command list written for an early access release: availability and behaviour can change.
If an automation needs remote access
Prefer the supported REST API where the installed version provides it. Pocketpair states that its administration APIs are intended for LAN use, not direct Internet exposure. Ask support to arrange an approved private network or authenticated tunnel. Do not add a publicly reachable administration port as a shortcut, and do not treat changing its port number as access control.
Inventory existing RCON tools before changing anything. Record what each tool does, who owns its credentials and whether it supports the current API. Test a replacement with read-only requests first. Keep a manual in-game administration route available during the transition. Disable the legacy listener once its consumers have migrated and support has confirmed the replacement works.
Diagnose without opening everything
- A timeout suggests the management route or listener is unavailable; verify the protected path with support.
- An authentication rejection suggests credentials or client configuration; rotate exposed secrets rather than posting them.
- A command failure after authentication may reflect changed command support. Check the installed release and current documentation.
- Confirm the response identifies the intended server before saving, kicking or shutting anything down.
When a maintainer leaves, revoke their panel access and private-network access as well as rotating shared administration credentials. Review automation secrets separately. Keep a short access list so future password changes do not silently break an unknown monitoring job.
Related guides
Further reading
- Pocketpair administration commands
- Pocketpair RCON deprecation notice
- Pocketpair REST API introduction
Looking for another game? Browse game server setup and troubleshooting guides.