Create and Secure a GSLT for a CS2 Server

Check Steam requirements

Steam's official page requires an unlimited account that is not locked or currently community banned, owns the game, and has a qualifying registered phone. Sign in only on steamcommunity.com and enable Steam Guard.

Do not use one maintainer's personal account when several people need to operate the server. Assign an accountable owner and a token-rotation procedure without sharing the account password.

Create the token for CS2

1. Open Steam Game Server Account Management.
2. Enter Counter-Strike 2 AppID 730.
3. Add a memo that identifies the instance without containing a secret.
4. Create the server account and copy its GSLT directly into secret storage.
5. Launch with +sv_setsteamaccount YOUR_GSLT, or use the host's designated secret field.

Use one token for one active instance. Create a new GSLT for a clone rather than running both with the same identity.

Store and validate without exposing it

Keep the token out of Git, screenshots, public tickets and shared shell history. Use a protected variable or the panel vault and restrict read access. Do not send it to a provider except through its documented secret input.

Restart and read the console: Steam should authenticate the game server account. Then test an external client and discovery. Redact the token before sharing logs. An authentication failure is not a reason to open more ports.

Revoke, rotate and troubleshoot

If the token appears in a log or message, treat it as compromised: stop the instance, delete the token on Steam, create another and update secret storage. Steam says support-assisted password resets regenerate GSLTs, while long-unused tokens may expire.

For rejection, check AppID 730, whitespace or quotes introduced by a panel, simultaneous use and account status. Never put the GSLT in server.cfg when multiple roles can download that file.

For the complete setup, follow the CS2 server guide and compare secret handling among CS2 hosts.

Quick questions

Does a GSLT let players administer CS2? No. It authenticates the server to Steam and does not replace RCON or in-game permissions.

Should a hosting provider know the token? Only its designated secret field needs it. Support conversations, screenshots and public configuration exports should never contain it.

What if the token has expired? Regenerate or replace it in Steam's account-management page, update secret storage, restart and confirm authentication in the redacted console log.