View Categories

Using Palworld RCON from Outside the Server

PALWORLD

On our Palworld servers, the RCON port and the REST API are not exposed to the internet. However, everything you would want to do over RCON can be done through the game panel API instead. This page explains why, and which commands are available.

3 min readUpdated 2026-08-13Palworld

In short: the panel API does the same job

On our Palworld servers, the RCON port (25575) and the REST API (8212) are not published to the internet.

That said, what you would use RCON for — listing online players, broadcasting, kicking or banning, saving, restarting — can all be done through the game panel API.

For how to create an API key, send commands and read their output, please see Managing Your Server Externally with the Panel API.

Why the RCON port is not exposed

  • In Palworld, the RCON password is the same as the admin password. If it became known to someone else, they could take full control of your server.
  • RCON traffic is not encrypted, so exposing it to the internet is not recommended.
  • Every additional open port increases the attack surface.

Through the panel API you get the same operations, protected by HTTPS encryption, an API key, IP restrictions and an activity log.

Commands you can use through the panel API

InfoServer name and versionWelcome to Pal Server[v1.0.3.101283] <server name>
ShowPlayersList players currently onlineCSV output after the header name,playeruid,steamid
Broadcast <text>Server-wide announcementBroadcasted: <text>
SaveManual saveComplete Save
KickPlayer <steamid>Kick a player 
BanPlayer <steamid>Ban a player 
Shutdown <seconds> <text>Shut down with a warning 
If you send a command that does not exist, the HTTP response is still 204 and the console shows Unknown command. Please check the console (WebSocket) for the actual result.

A note on Broadcast

Broadcast drops everything after the first space. This is how Palworld itself behaves.
Example: Broadcast Hello From API → only Hello is shown in game.

Use underscores (_) instead of spaces:

Broadcast The_server_will_restart_in_5_minutes
If anything is unclear, please open a support ticket in the client portal — we are happy to help.
Scroll to top