Fix: Players Kicked for 'Invalid STEAM UserID Ticket'

A player connects, then is dropped with:

Invalid STEAM UserID Ticket

This means the server asked Steam to validate the client's identity and the validation failed or never completed. There are two entirely different situations behind it, and the fix depends on which one you are in: you are running a non-Steam server and want non-Steam clients to join, or you are running a Steam-authenticated server and the auth path is broken.

1. Decide which server you are running

If your community is non-Steam (pirated clients, common in many regions), a stock server will reject every one of them with this ticket error, because they have no valid Steam ticket to present. The fix is to install a client-authentication emulator: Reunion on ReHLDS, or dproto on original HLDS. If your server is meant to be Steam-only and legitimate Steam users are being kicked, skip to step 4.

2. Non-Steam: install Reunion (ReHLDS)

Reunion is a Metamod plugin that lets non-Steam clients authenticate while still allowing real Steam clients. It requires ReHLDS and Metamod-r. Drop the Reunion binary into addons/reunion/ and register it in Metamod's plugin list:

// addons/metamod/plugins.ini
linux addons/reunion/reunion_mm_i386.so

3. Configure reunion.cfg — the salt is mandatory

Reunion needs a SteamIdHashSalt of at least 16 characters or it refuses to load. This salt is what generates stable IDs for non-Steam players, so admin flags and stats stay attached to the right person. In addons/reunion/reunion.cfg:

SteamIdHashSalt = a-long-random-string-min-16-chars

// which client types to accept
cid_Steam = 0
cid_NoSteam = 2

Pick a random salt and never change it afterwards — changing the salt re-hashes every non-Steam SteamID, wiping every player's admin access and stats in one restart. Keep it secret and backed up.

4. Steam-only server: fix the auth path

If you want genuine Steam validation and real users are kicked, the server itself cannot reach Steam auth. Common causes:

• The engine is too old after the 2023 25th-Anniversary update. Update HLDS, or move to ReHLDS.
• Missing Steam runtime files. The server needs steamclient.so and a steam_appid.txt present; without them it silently falls back and cannot validate tickets.
• You launched with -insecure expecting security, or the reverse — check your launch line.

Confirm the runtime files exist next to the engine and re-run app_update 90 validate in SteamCMD if they are missing.

5. Do not mix Reunion with a secure/VAC expectation

Once Reunion is accepting non-Steam clients, the server is by definition not VAC-secure — that is the trade. Run it -insecure to avoid the misleading "not VAC secured" churn, and rely on ReChecker and admin tooling for integrity instead.

6. Original HLDS: use dproto instead

If you are on stock Valve HLDS rather than ReHLDS, Reunion is not the tool — dproto is. It is also a Metamod plugin and it serves the same purpose: accepting both Steam and non-Steam clients and giving non-Steam players a stable ID. Install it into addons/dproto/ and register it in plugins.ini, then configure the client acceptance modes in dproto.cfg. The design decision is the same as Reunion's salt: pick your ID-generation settings once and do not change them, or every non-Steam player's admin access and stats reset. The broader recommendation still stands — run ReHLDS with Reunion rather than HLDS with dproto, because the ReHLDS stack is what is actively maintained.

Common errors

• Every client kicked with the ticket error — non-Steam community on a stock server; install Reunion or dproto.
• Reunion does not load — SteamIdHashSalt is missing or shorter than 16 characters. Check the AMXX/Metamod log for the refusal line.
• All admins lost access after an edit — you changed SteamIdHashSalt. Restore the old salt from backup.
• Only some clients kicked — those are non-Steam on a server configured Steam-only; adjust cid_NoSteam.
• Steam clients kicked after 2023 update — outdated engine; update or switch to ReHLDS, and have clients try the steam_legacy branch.

Verification

After configuring Reunion, connect with a client and check the console at connect time — the player should join without the ticket kick. In the server console, meta list must show Reunion as RUN. Then confirm IDs are stable by reconnecting: the player's SteamID (as seen in amx_who or the logs) must be identical across reconnects. If it changes each time, the salt is not being read.