Valheim Server

How to Whitelist Players on a Valheim Server

Valheim’s allow-list is a plain-text file called permittedlist.txt in the server’s data directory: put one SteamID64 per line and only those players can join, regardless of the password. It’s the strongest access control the vanilla server offers, and it’s also the easiest way to accidentally lock out your entire group — because an empty file means “everyone welcome” while a file with a single typo means “nobody but that typo”.

Where the file lives

Alongside the other permission files, in the Valheim data directory:

Windows: %USERPROFILE%\AppData\LocalLow\IronGate\Valheim\permittedlist.txt
Linux:   ~/.config/unity3d/IronGate/Valheim/permittedlist.txt
Docker:  <your config mount>/permittedlist.txt

On Linux that’s the home directory of whichever user runs the server, which is worth double-checking if you set the service up under a dedicated account. If the file doesn’t exist yet, the server usually creates a commented placeholder on first run; if it hasn’t, creating it yourself works fine.

How the logic works

Empty list, no restriction. With no entries, the allow-list is inactive and anyone with the address and password can join. This is the default and it’s fine for a private, unlisted server among friends.

Any entries, strict allow-list. The moment there’s one valid ID in the file, the server stops accepting anyone who isn’t listed. There’s no middle setting.

It’s independent of the password. An allowed player still needs the password; a non-allowed player is refused even with it. Think of them as two separate doors.

It’s independent of admin rights. Being in adminlist.txt doesn’t grant entry. If you enable the allow-list, your admins need to be in both files. This is the classic lock-yourself-out mistake.

Get everyone’s SteamID64

A SteamID64 is the 17-digit numeric ID for a Steam account — not the display name and not the custom URL. Ways to find it:

  • From the server log. The simplest reliable method: have each person join once with the list still empty, and read their IDs out of the connection lines in the server output. On systemd, journalctl -u valheim | grep -i steam narrows it down; in Docker, docker compose logs valheim.
  • From a SteamID lookup tool. Paste the player’s profile URL into one of the well-known SteamID converter sites and take the 64-bit value. Ask them for their profile link — a display name isn’t enough, because names aren’t unique.
  • From the player’s own client, if they’ve enabled the option that shows their ID in the Steam interface.

Collect them all before you enable the list. Getting IDs from people who can no longer connect is a slow, annoying loop.

Write the file

One ID per line, no commas, no quotes, no trailing spaces:

76561198000000001
76561198000000002
76561198000000003

Some builds accept # comment lines, and the placeholder file the server generates may use them. Keeping a comment per line is genuinely useful six months later, but if in doubt, keep the file to bare numbers — a comment style the server doesn’t parse turns into an invalid entry. Maintain your own annotated copy elsewhere instead:

76561198000000001   # Erik
76561198000000002   # Sigrid

Then restart the server to be certain the file is loaded:

sudo systemctl restart valheim

The permission files are re-read without a reinstall, and often without a restart, but a restart removes all doubt when you’re testing access control.

Test it deliberately

Do this while you still have a way back in:

  1. Add your own ID first and confirm you can still join.
  2. Add the rest of the group.
  3. Have one person who is not in the list try to join, and confirm they’re refused.

If nobody can get in, empty the file (or move it aside), restart, and start again — the failure mode is almost always a mistyped ID, a wrong ID format (a 17-digit SteamID64, not a shorter legacy form), or the file sitting in the wrong directory because you were looking at the wrong user’s home.

Crossplay complicates this

When crossplay is enabled, players arriving from other platforms don’t have a Steam ID in the usual sense — their identity comes from the cross-platform network instead. That means an allow-list keyed to SteamID64s behaves differently for them, and the ID you need to list may be a different value entirely.

Since the exact behaviour here has changed as crossplay developed, verify it on your own build rather than trusting a general claim: enable crossplay, have a non-Steam player join with the list empty, and read what identifier appears in the server log for them. If your group is mixed-platform and you need strict access control, test this before you rely on it. Background in How to Enable Crossplay on a Valheim Server.

Allow-list versus the alternatives

Three ways to keep strangers out, in increasing strength:

  • Don’t advertise the server. Launch it unlisted so it never appears in the browser. Stops casual discovery; anyone with the address can still try.
  • A strong password. Stops opportunists. Leaks the moment a screenshot does.
  • The allow-list. Actually enforces a named group. Slightly more admin work.

For a stable friend-group server, unlisted plus a decent password is usually enough. Reach for the allow-list when you’ve had an uninvited guest, when the address has been shared publicly, or when you’re running something you care enough about to control precisely.

The same directory holds adminlist.txt (admin rights) and bannedlist.txt (blocks). All three take the same one-ID-per-line format, and they answer different questions: may you join, what can you do, and are you barred. Admin setup is in Essential Valheim Admin Commands and Automated Backups, and bans in How to Kick and Ban Players on a Valheim Server.

Keep a backup of all three files with your world backups. They’re tiny, they encode decisions you’d rather not reconstruct, and they’re trivially easy to lose in a server rebuild.

adminconfiguration