Steam game server login tokens (GSLT) explained

A Game Server Login Token is a 32-character string that lets a dedicated server log in to Steam as a persistent identity rather than as an anonymous process. It is free, it takes about a minute to create, and it is the reason a perfectly working server sometimes cannot be found by anybody. It is also a credential tied to your personal Steam account, with your name on whatever the server does, which is why the one rule that matters most is the one people break first: never use a token somebody else created, and never hand yours to anybody.

What a GSLT is, and what it is not#

Steam games that use the Steamworks game server API can log in one of two ways. An anonymous game server starts, works, and accepts direct connections, but Steam does not know who is running it. A server logged in with a game server account has an identity: Valve knows which Steam account it belongs to, the server appears in the public browser, and players' Favorites and History entries follow it if its address changes.

The token is the password for that account. You create the account on Steam's game server account page, Steam gives you the token, and the server presents it at startup.

What it is not:

• Not a licence. It costs nothing and grants nothing. There is no paid tier.
• Not a DDoS or anti-cheat feature. VAC is separate and works without one.
• Not per-player. It authenticates the server, not the people on it.
• Not interchangeable between games. A token is created against one app id and is rejected by every other game.
• Not shareable between running servers. One token, one live server. Two servers presenting the same token log each other out, repeatedly, which looks like an unstable server rather than a configuration mistake.

Who is allowed to create one#

Valve publishes the requirements on the page itself, and they are stricter than most people expect:

• Your Steam account must not be currently community banned or locked.
• Your Steam account must not be limited.
• Your Steam account must have a qualifying registered phone.
• Your Steam account must own the game you are creating the account for.
• One account may create 1000 game server accounts.

A limited account is the one that trips people up. Steam limits accounts that have never spent money, and a limited account cannot create tokens at all. So does the phone requirement: an account without a registered phone number is not eligible, whatever else is true of it.

The ownership rule is why a host cannot create your token for you even in principle for most games. It also shapes a practical decision: if you are going to buy a copy of the game specifically to run servers, buy it on an account that holds nothing else. Valve's own wording is that if your game server accounts are banned for any reason, you may be restricted from playing the associated games. That is a consequence you want landing on a spare account.

Creating a token#

1. Sign in at steamcommunity.com/dev/managegameservers with the account that owns the game.
2. Enter the app id of the game, not of the dedicated server tool. The next section is entirely about this.
3. Write a memo. This is a free-text label and the only thing that will tell you six months from now which of your eleven tokens belongs to which server. "eu-survival-01" is a memo; "server" is not.
4. Create it, and copy the 32 hexadecimal characters.

Memo:     thursday-survival-01App ID:   304930Token:    0123456789ABCDEF0123456789ABCDEF

Create one per server you intend to run at the same time. There is no cost and no limit worth worrying about, and the alternative - reusing one across two live servers - produces an intermittent failure that is genuinely hard to diagnose from the inside.

Which app id - the mistake everyone makes#

The token is created against the game's app id. Most Steam games ship their dedicated server as a separate application with a different id, and that is the id you give to SteamCMD, not to the token page. Using the server's id produces a token the game rejects with an unhelpful message.

Counter-Strike 2 is the exception that makes the rule confusing: the server and the game share app id 730, so for that one game the numbers match and nothing goes wrong by accident. Euro Truck Simulator 2 is the clearest example of the trap, with 227300 for the token and 1948160 for the install, and its own documentation calls the mistake out explicitly. SteamCMD explained has the wider list of server and game app ids and why they differ.

Where the token goes, game by game#

Each game reads the token from its own place, and several of them have a rule about when it must be read.

Unturned's is the other one with a rule: put the token in Commands.dat or in the Browser section of the gameplay config, not both. Its documentation also lists two benefits beyond being listed that other games do not advertise. A server with a token keeps the same Server Code between restarts rather than generating a new one each time, and Steam can move players' Favorites and History entries to the server's new address if it changes, typically within about a day. Unturned server setup covers where both fields live.

What a server does without one#

This is the single most common "my server is broken" report, and the server is usually not broken.

• Source engine games run normally and accept direct connections with connect 203.0.113.10:27015. They do not register with Valve's master servers, so they never appear in the community browser. Workshop downloads can also fail on some of them.
• Unturned treats a server without a token as anonymous and hides it from the Internet server list entirely. It still works over LAN, through a Steam friends invite, and by Server Code, and the code changes on every restart.
• Euro Truck Simulator 2 runs as an anonymous server with a weaker identity in the browser.
• Counter-Strike 2 will run, but a public server without a token is an unlisted server, which for most people is the same as a broken one.

The test that settles it in thirty seconds: try to join by IP. If a direct connection works and the browser does not show the server, the problem is the token or the query port, not the game. If a direct connection also fails, it is the port. Game server ports explained covers telling those two apart, and the query port specifically, because a server missing from the browser has exactly two plausible causes and this post covers one of them.

Bans, expiry and regeneration#

Tokens can be banned, and the consequences reach further than the server.

A banned token cannot authenticate, so the server drops off the browser and, in VAC-secure games, may stop accepting connections. Valve bans tokens for the things you would expect: running or facilitating cheats, VAC-bypass configurations, servers that exist to advertise scams, and repeated violations of the game's own server hosting rules. What people underestimate is the account-level consequence, which Steam states plainly on the page: you are solely responsible for these tokens, and if your game server accounts are banned for any reason, you may be restricted from playing the associated games.

That last clause is the argument for a spare account, and it is also the argument against running plugins you have not read. A plugin that quietly turns your server into something Valve objects to costs you the server and possibly your ability to play the game. Keeping a modded server clean covers the hygiene; the rules on what you may sell to players before a token becomes a liability are in monetising a game server within the rules.

Two administrative behaviours catch people out:

1. Unused tokens expire. A token whose server never logs in will eventually be marked expired. It can be regenerated from the same page, which issues a new value - so the config on any server still using the old one has to be updated.
2. A Steam password reset regenerates every token you have. If you reset your password through the Steam help website, or Steam Support resets it for you, all of your GSLTs are regenerated at once. This is deliberate, and it is the right behaviour, and it means a password reset silently unlists every server you run until you go and update each one.

Put that second point on whatever list you keep of things that break production. It is the only failure in this post that hits every server you own simultaneously.

Keeping the token secret#

A GSLT is a credential. It identifies your account to Steam, it carries your liability, and Valve's own instruction on the page is unambiguous: do not distribute game server login tokens to third parties, and if you have already done so, delete the token.

The practical version of that:

• Never accept a token from a host. A host that hands you a working token has handed you somebody else's credential, and the consequences of whatever your server does will land on them. Any host that asks you to supply your own is doing the right thing, not being unhelpful.
• Never paste it into Discord, a forum, a screenshot or a support message in a public channel. If you need to send one to somebody helping you, send it privately. On RE:NODE a support ticket takes private attachments, which is the right place for anything like this.
• Keep it out of version control. A token in a committed server.cfg is a token in every clone of that repository for ever, and deleting the commit does not remove it from history. Environment variables and secrets covers the general pattern.
• Think about who can read your files. Anyone with file-manager or SFTP access to the server can read the config the token sits in, and on Source games anyone with RCON can often read the convar. Give staff console access without file access where the panel allows it - subusers and least privilege covers building roles that do this - and treat RCON with the care described in RCON safely.
• Rotate deliberately. If a token has been seen by somebody it should not have been, delete it and create a new one. It takes a minute, and there is no reason to hesitate.

On RE:NODE, Counter-Strike 2 and Unturned are the two games in the catalogue that need a token, and the token is yours to create. The server is built as soon as payment clears and the install waits on the Setup tab until you paste it in. That is a deliberate decision rather than a missing feature. The value goes into a startup variable rather than being written into a file by the install, which keeps it out of anything a backup or a screenshot would capture.

Troubleshooting#

The server runs but never appears in the browser. No token, a token for the wrong app id, an expired or banned token, or a closed query port. Check in that order; join by IP to isolate which half of the problem you have.

"Token is not valid" or a rejected login at startup. Almost always the app id. A token created against a dedicated-server app id rather than the game's will never work.

The server logs in and then logs out repeatedly. Two live servers are sharing one token. Create a second token; there is no downside.

Every server I run went unlisted at once. Your Steam password was reset through Steam Support or the help website, which regenerates all tokens. Collect the new values and update each server.

A token that worked last month is refused. It expired through disuse, or it was banned. The management page shows which; an expired token can be regenerated, a banned one cannot.

The token is correct and CS2 still is not listed. Confirm the convar is on the launch line rather than in server.cfg, and that nothing else is setting it later. Counter-Strike 2 server setup covers the full launch line.

A host offered me a token. Decline, and reconsider the host. There is no legitimate version of this.

FAQ#

Do I need a GSLT to run a server at all?

Only for a public, listed server. Every game listed here runs and accepts direct connections without one. What you lose is the entry in the community server browser, and in Unturned's case a stable Server Code.

Can my hosting provider create the token for me?

They should not, and for most games they cannot without owning the game on an account of their own. The token carries the liability for what the server does, so it belongs to the person running the server. A host asking you to supply one is behaving correctly.

How many tokens do I need?

One per server that is running at the same time. Sharing a token between two live servers makes both of them unstable, because each login kicks the other out. Steam allows 1000 game server accounts per Steam account, so there is no reason to economise.

What gets a token banned?

Cheats, VAC-bypass configurations, scam or advertising servers, and repeated breaches of the game's own hosting rules. The ban stops the server authenticating, and Valve's own wording is that a banned game server account may result in you being restricted from playing the associated game.

Which app id do I use?

The game's, not the dedicated server tool's. Team Fortress 2 is 440 even though its server installs from 232250; Euro Truck Simulator 2 is 227300 even though its server installs from 1948160. Counter-Strike 2 is the exception where both are 730.

My token stopped working and I did not change anything.

Two likely causes. It expired because that server had not logged in for a long time, or your Steam password was reset, which regenerates every token on the account. Both are fixed on the same page, and both need the new value copied into the server's configuration.