Your FiveM server starts, oxmysql loads, and then the console fills with ER_ACCESS_DENIED_ERROR: Access denied for user. You copied the host, the username and the password straight from the panel, so the obvious conclusion is that the database user is not allowed to connect from your server.
It almost never is. In the overwhelming majority of these reports the credentials are correct and the connection string is the problem. Your password contains a character that the format you used cannot carry, so oxmysql sends MySQL a password that is not the one you copied, and MySQL does exactly what it should. It refuses.
Why the password gets mangled
oxmysql accepts two different formats in mysql_connection_string, and each one breaks on a different set of characters.
Key and value form
set mysql_connection_string "user=s12_user;password=SECRET;host=1.2.3.4;port=3306;database=s12_economy;charset=utf8mb4"
oxmysql splits this on ; and then on =, keeping the first two pieces. So a ; or an = anywhere in your password silently cuts it short. No warning, no parse error, just a shorter password than the one you pasted.
URI form
set mysql_connection_string "mysql://s12_user:[email protected]:3306/s12_economy?charset=utf8mb4"
This one is matched with a regular expression and the user info is split on :. The match runs greedily to the last @, which means an @ in your password is perfectly safe here. A :, /, ? or # is not, because each one ends a different part of the URI.
A " breaks both forms, because the whole value sits inside a quoted convar and the quote closes it early.
So there is no single format that survives every password. There is a format that survives your password, and picking the wrong one is what produces access denied.
Do not percent-encode your password
This is the most repeated piece of bad advice on the subject, and it makes things worse.
oxmysql's URI parser does no percent decoding. If your password is p@ss and you helpfully write it as p%40ss, oxmysql sends the literal characters p%40ss to MySQL, which is not your password, and you get access denied for a brand new reason. In the URI form the password goes in raw, exactly as the panel shows it.
Percent-encoding is correct for database URIs in plenty of other software. It is wrong here.
The fix: copy the line the panel builds
You do not have to work out which format your password needs. Open your server in the panel, go to the Databases tab, and look at the oxmysql connection string card underneath your database.
That card holds the complete set mysql_connection_string "..." line, already assembled from your host, port, username, database name and password, in whichever of the two formats can carry your particular password. Use the copy button rather than selecting the text by hand, so the real password is copied even while it is masked on screen.
If the card shows a warning and a Generate new password button instead of a string, your password contains a combination that neither format can express, such as a ", or both an = and a :. Press the button. You get a new working password in a second, and the card then renders a valid line.
Where the line goes
Paste it into server.cfg, near the top.
The one rule that matters is order. set mysql_connection_string must appear before ensure oxmysql. oxmysql reads the convar when it starts, so a connection string placed further down the file is read too late and the resource comes up with nothing.
If txAdmin manages your server, add it in the txAdmin settings instead of editing server.cfg by hand. txAdmin regenerates parts of the config, and an edit made in the file can be overwritten.
Restart the server after changing it. Reloading the resource on its own is not enough, because the convar is read at resource start.
Confirm it worked
Open the Console tab and restart. A healthy oxmysql prints a line confirming it connected to your database and reports the MySQL version. If the credentials are wrong you get the access denied line again immediately, within a second or two of the resource starting.
A connection that hangs for many seconds and then fails is a different problem. That is the host or the port being unreachable, not the password.
Troubleshooting
Access denied, and my password contains ; or =. You are on the key and value form and your password is being truncated. Switch to the URI form, or rotate the password.
Access denied, and my password contains :, /, ? or #. You are on the URI form and the password is being cut at that character. Switch to the key and value form, or rotate the password.
Access denied, and my password contains @. On the URI form this is fine and the @ is not your problem. Check the username and the database name instead. If you percent-encoded the @ as %40, undo that.
Access denied for an empty username. The line is malformed rather than wrong. A stray quote or a missing set keyword usually does this. Re-copy the whole line from the panel.
Unknown database. The database name and the username look almost identical, because both carry the same generated prefix. It is easy to paste one where the other belongs. In the panel the username is the value under Username, and the database name is the heading of the row.
Connection timed out, or connect ECONNREFUSED. Not a credentials problem. Check that you used the full host from the panel including the port after the colon, and that you did not replace it with localhost or 127.0.0.1. Your database does not live on the same machine as your game server, so those addresses point somewhere else entirely.
It worked yesterday and stopped today. Someone pressed New password on the database, either you or another user with panel access. Rotating invalidates the old password immediately. Copy the new line.
oxmysql says no connection string was found. The convar sits below ensure oxmysql in server.cfg, or txAdmin has overwritten your edit.
Frequently asked questions
Is the database user restricted to certain hosts? No. Databases created from the panel accept connections from any host, so a database user blocked by host is not the cause of your access denied error. This is worth saying plainly, because it is the first thing almost everyone suspects.
Which format should I use? Whichever one the panel gives you. It picks the key and value form by default and switches to the URI form when your password needs it.
Can I just remove the special characters from my password? In effect, yes. Pressing New password generates a fresh one, and if it lands on something both formats can carry, the panel renders the simpler form. You cannot choose your own password, so rotating is the way to reach a friendlier one.
Does this apply to ESX and QBCore? Yes. Both are built on oxmysql and read the same convar. The same line works for either.
Do I need charset=utf8mb4?
It is not required, but keep it. oxmysql defaults to utf8mb4 anyway, and stating it explicitly is what stops accented characters in player names from being stored incorrectly on servers whose MySQL default is older.
Can I put the connection string in a resource config instead? Do not. Frameworks read it from the convar, and a second copy in a resource file is one more place to keep in step when the password is rotated.
Should I share my connection string when asking for help? No. It contains the password in full. Share the error line from the console and say which format you used, never the string itself.
Still getting access denied after copying the line from the panel? Contact support with your server name and the exact console output, with the password removed, and we will check the database from our side. Do not have a server yet? See our FiveM server hosting plans.