How to Replace an Exposed CS2 Game Server Login Token

Valve instructs operators not to distribute game-server login tokens to third parties and to delete a token that has been distributed. Use the following.

Valve instructs operators not to distribute game-server login tokens to third parties and to delete a token that has been distributed. Use the following documented account-management options to replace an exposed Counter-Strike 2 token.

1. Identify the affected account

Valve's IGameServersService documentation documents two relevant lookup methods:

• GetAccountList returns the caller's game-server accounts and their login tokens.
• QueryLoginToken reports the status of a specified token owned by the caller.

Both methods require a Steamworks Web API user authentication key.

2. Delete or reset the exposed token

Use Valve's Steam Game Server Account Management page to delete a token that was distributed to a third party.

The Web API also documents ResetLoginToken, which generates a new login token for a specified game server. Do not confuse this with DeleteAccount, which deletes the persistent game-server account itself.

3. Create a replacement account when needed

Counter-Strike 2 uses Steam App ID 730, as shown by its Steam store listing.

The documented CreateAccount method creates a persistent game-server account and requires an App ID, a memo, and a Steamworks Web API user authentication key. Use App ID 730 when creating an account for a CS2 server.

For general server discovery while reviewing your deployment, you can browse live game servers on LiveGameServerList.

4. Account-wide password resets

Valve states that resetting a Steam password through the Steam Help website, or having Steam Support reset it, regenerates every Game Server Login Token belonging to that account. Account operators should therefore account for all affected tokens when a password reset occurs.