Use one password for joining Palworld and a different one for administration. Keep the REST endpoint reachable only through an intended private path. Pocketpair explicitly says the API is not designed for direct Internet exposure; a password does not change that boundary.
This walkthrough is for an existing dedicated server on a Linux VPS, with SSH access to the game host and OpenSSH plus curl on the administrator's computer. It uses the REST API documented in the current server guide. Windows dedicated servers use a different configuration directory; the access model is the same.
Separate joining, discovery and administrative access#
ServerPassword controls joining the game. AdminPassword grants administrative authority and is also the password used by REST Basic authentication with username admin. Neither is your SSH password, Linux username or Steam account credential.
A server omitted from the community list can still be reached by a known address. Treat discovery and access control separately: use the game password where appropriate, and decide who may reach the game port. Protecting REST does not automatically make the game itself private.
For a small group, record three intended paths: players to the game endpoint, operators to SSH, and private monitoring to REST. If no integration needs REST, leave it disabled. Do not enable it simply because a container example does.
Edit the effective settings, preserving the rest#
Stop the game normally and retain a copy of its active configuration. Linux uses Pal/Saved/Config/LinuxServer/PalWorldSettings.ini; Windows uses WindowsServer in that path. Editing DefaultPalWorldSettings.ini does not change the active configuration.
In the existing OptionSettings=(...) value, set distinct strong ServerPassword and AdminPassword values, then set RESTAPIEnabled=True and the intended RESTAPIPort, here 8212. These are fields in the existing settings, not separate INI sections. Do not replace the whole line with four fields and accidentally discard the world's other rules.
If a container generates this file from environment variables, change the generator's source configuration instead. A manual edit that is overwritten on startup leaves you testing a password the game never loaded. Check your particular image's mapping of environment variables to the game settings; names are wrapper-specific.
Establish a private route before enabling remote use#
For a directly installed server, block unsolicited external TCP access to 8212 at the provider and host/network policy layers before starting it. The SSH service on the game host must be able to reach 127.0.0.1:8212. Do not assume that RESTAPIPort also sets a loopback bind address.
For a normal Docker bridge in NAT mode on a current Engine, publish REST to host loopback. In the existing Palworld service's ports list, the relevant entry is:
- "127.0.0.1:8212:8212/tcp"
Replace an all-interface mapping for that same port; do not leave both entries. Keep the game's UDP mapping separate. This is a Compose fragment, not a complete service definition, and it does not apply to host networking, Swarm or routed container networks. Docker also documents localhost-publishing exposure on Engine versions older than 28.0.0; update or account for that before relying on this boundary.
Apply the network change during the maintenance window, then confirm from an outside machine that the public REST endpoint is inaccessible, including public IPv6 where present. Check both the policy and the actual route. A local HTTP success alone says nothing about external exposure.
Open the tunnel and make a read-only request#
On your own computer, replace operator@server.example.com with the SSH account and hostname of the game host. Keep this terminal open:
ssh -N -o ExitOnForwardFailure=yes -L 127.0.0.1:18212:127.0.0.1:8212 operator@server.example.com
Here 18212 belongs to your computer; 8212 belongs to the remote host. The destination loopback is evaluated on the SSH server. If SSH terminates at a bastion or another container, that loopback is not automatically the game host. Correct the topology instead of opening REST publicly to compensate.
From a second local terminal, request server information:
curl --noproxy '*' --connect-timeout 5 --max-time 15 --silent --show-error --include --basic --user admin http://127.0.0.1:18212/v1/api/info
curl prompts for the configured AdminPassword. Keeping the password out of the command avoids placing it in shell history. On Windows PowerShell, use curl.exe if curl resolves to an alias. The HTTP request travels inside SSH across the Internet and reaches the game's plain HTTP service locally. Basic authentication itself is not encryption, and Base64 is not a replacement for the tunnel.
Diagnose the layer that actually failed#
| Observation | Next check |
|---|---|
| SSH cannot bind 18212 | Select an unused local port and change the curl URL to match. |
| SSH reports a failed forwarded connection | Check the listener, active config and destination from the SSH host's network. |
| curl times out or is refused | Check that the tunnel remains open and targets the correct host/port. |
| HTTP 401 | Check username admin, effective AdminPassword, restart and generated settings. The joining password is different. |
| HTTP 404 | Check /v1/api/info and whether the response came from Palworld or another service. |
| HTTP 200 with expected information | Compare servername, version and worldguid; the wrong instance can also answer successfully. |
Do not test authentication with shutdown, ban or force-stop calls. /info is enough to establish the route without modifying the world. Keep the same private path for later automation, and treat the admin credential as powerful even when an integration only reads status. Restrict its file access, redact headers and rotate it if disclosed. For services running on your own VPS, Nexardo offers infrastructure management; the private game-administration boundary still needs explicit configuration.
Sources#
- Pocketpair: server settings and configuration paths
- Pocketpair: REST API authentication and network-access guidance
- Pocketpair: read-only server information endpoint
- Maintained Palworld container: REST authentication implementation
- OpenSSH: local forwarding, curl: authentication and request options, Docker: port publishing boundaries
