Configure a TF2 Server GSLT and server.cfg

Create and protect the TF2 GSLT

Sign in to Steam Game Server Account Management. The account must meet Steam's conditions: unlimited, not locked or currently community banned, with a qualifying phone and ownership of the associated game. Create the token with AppID 440, add an instance memo, then place it in secret storage.

Launch srcds with +sv_setsteamaccount YOUR_GSLT. Use one token per active instance. On exposure, stop, delete it on Steam, create another and update secret storage. A Steam support password reset may also regenerate tokens.

Build a minimal readable server.cfg

Stop the server, back up tf/cfg and create tf/cfg/server.cfg. Start with:

• hostname for public naming;
• optional sv_password for a private event;
• a long unique rcon_password only when RCON is used;
• time, round and team limits suited to the mode;
• community-approved voice and spectator settings.

Comment each block and keep a secret-free version. Mode or plugin files may overwrite values, so inspect the console after full load rather than trusting file contents alone.

Rotation, administration and tests

Put one valid official map per line in tf/cfg/mapcycle.txt. Start with two installed maps, finish a round and observe automatic change. Custom maps and FastDL require separate distribution; wait until official rotation is reliable.

Restrict RCON at the network when possible and never reuse the GSLT or join password. Test administration with minimum privileges. Include bans and logs in backups.

Post-update validation and troubleshooting

After changes: restart, confirm Steam authentication in the console, join from another network, inspect name and rules, complete a map, then restart again. For GSLT failure, check AppID, whitespace, expiry or double use; do not open more ports.

After app_update 232250 validate, reapply only required customizations and test before plugins. The TF2 installation guide provides the baseline. Compare panel controls among TF2 hosts.

Quick questions

Is a GSLT the RCON password? No. The GSLT authenticates the server to Steam; RCON grants remote administration. Never reuse either secret.

Why does a setting reset on map change? A mode, map or plugin configuration may execute after server.cfg. Read the console execution order and change the file that owns the value.

Can two TF2 servers share one token? They should not. Give each active instance a separate GSLT so identity, revocation and incidents remain isolated.