---
title: "How to Make Your Server Accept Non-Steam Players"
excerpt: "Let non-Steam CS 1.6 clients connect: Reunion on ReHLDS or dproto on HLDS, the mandatory SteamIdHashSalt, and how admin identification changes when SteamIDs are not real."
category: "installation"
tags: "non-steam, reunion"
image: ""
read_time: "8 min read"
---
<p>Out of the box a CS 1.6 server validates clients against Steam and rejects non-Steam ("no-Steam") builds. Accepting them is a deliberate choice: you install a connection-layer plugin that answers the validation itself and assigns each non-Steam player a SteamID. There are two, and which one you use depends on your engine: <strong>Reunion</strong> on <a href="/tutorials/install-rehlds-on-linux">ReHLDS</a>, <strong>dproto</strong> on original HLDS. Do not run both.</p>

<h2>1. Pick the right one for your engine</h2>
<ul>
<li><strong>ReHLDS → Reunion.</strong> Reunion is written for ReHLDS and is the current, maintained choice. This is what you should be running.</li>
<li><strong>Original Valve HLDS → dproto.</strong> dproto predates ReHLDS and still works on stock engines. If you are on stock HLDS in 2026, the better move is to switch to ReHLDS + Reunion.</li>
</ul>
<p>Both are Metamod plugins, so you need a working Metamod-r first — verify with <code>meta list</code>.</p>

<h2>2. Install Reunion (ReHLDS)</h2>
<p>Reunion ships as a Metamod plugin plus a config. Place the plugin binary under the addons tree and register it in Metamod's plugin list:</p>
<pre>cstrike/addons/reunion/reunion_mm_i386.so     &lt;-- the plugin
cstrike/addons/reunion/reunion.cfg            &lt;-- its config</pre>
<p>Add it to <code>cstrike/addons/metamod/plugins.ini</code> above AMXX:</p>
<pre>linux addons/reunion/reunion_mm_i386.so</pre>

<h2>3. Set the mandatory SteamIdHashSalt</h2>
<p>This is the step people miss, and Reunion will not load without it. In <code>reunion.cfg</code>:</p>
<pre>SteamIdHashSalt = your_long_random_salt_at_least_16_chars</pre>
<p><strong>The salt must be at least 16 characters.</strong> Shorter and Reunion refuses to start, which shows up as Reunion missing from <code>meta list</code>. The salt is what turns a non-Steam player's identity into a stable <code>STEAM_ID</code>-style string — change it later and every non-Steam player's ID changes with it, which resets their stats and their admin access. Set it once and never touch it.</p>

<h2>4. Decide who is allowed in</h2>
<p>Reunion's config controls which client types are accepted — Steam, non-Steam (Steam emulators / Revolution Emulator), or both. Configure the authentication providers in <code>reunion.cfg</code> to match your policy. The common setups are "both Steam and non-Steam" (maximum audience) or "non-Steam only" (a purely no-Steam community). Read the shipped config's comments for the exact provider keys in your build rather than guessing.</p>

<h2>5. Fix admin identification</h2>
<p>This is the real operational consequence. A non-Steam player's SteamID is generated from their name and your salt, not issued by Valve — so it is only as trustworthy as the name is unique. For admins on a non-Steam-friendly server you have two choices:</p>
<ul>
<li><strong>Name + password auth</strong> in <code>users.ini</code> — the reliable option for non-Steam admins:</li>
</ul>
<pre>; users.ini
"AdminName"  "adminpassword"  "abcdefghijklmnopqrstu"  "a"</pre>
<p>with the matching flags including the "requires password" flag, so an impostor with the same name but no password gets nothing. Relying on the generated SteamID alone for admin access on a non-Steam server is how admin gets stolen.</p>

<h2>Common errors</h2>
<ul>
<li><strong>Reunion missing from <code>meta list</code></strong> — the <code>SteamIdHashSalt</code> is unset or shorter than 16 characters, or the <code>plugins.ini</code> path/architecture is wrong (Linux line must point at the <code>.so</code>).</li>
<li><strong>Non-Steam clients still get <code>STEAM validation rejected</code></strong> — Reunion/dproto is not actually loading, or you left VAC/secure mode fighting it. See <a href="/tutorials/fix-steam-validation-rejected">the validation-rejected fix</a>.</li>
<li><strong>Running Reunion and dproto together</strong> — they both answer validation and conflict. Pick one.</li>
<li><strong>All non-Steam players share one SteamID</strong> — the salt is empty or the provider config is collapsing identities. Set a proper salt and correct providers.</li>
<li><strong>Admins lost access after a config change</strong> — you changed the salt, which changed every generated ID. Move admins to name+password auth.</li>
</ul>

<h2>Verification</h2>
<p>Restart and confirm the plugin loaded:</p>
<pre>meta list</pre>
<p>Reunion (or dproto) must show as <code>RUN</code>. Then connect with an actual non-Steam client and, in the server console, run <code>status</code> — the player must appear with a <code>STEAM_</code> ID, not be rejected. Have that player disconnect and reconnect: their ID must stay the same across sessions (this is what the salt guarantees). Finally, log an admin in via name+password and confirm <code>amx_who</code> shows their flags. When a non-Steam player connects, keeps a stable ID, and a non-Steam admin authenticates, the setup is complete.</p>

<h2>What accepting non-Steam actually costs you</h2>
<p>It is worth being clear-eyed about the trade, because it is not free. A Valve-issued SteamID is cryptographically tied to an account; a Reunion-generated ID is a hash of a name and your salt, so on a non-Steam-friendly server, identity is roughly "whoever types this name". That has three practical consequences you should plan for from the start:</p>
<ul>
<li><strong>Stats and reserved slots keyed on SteamID are spoofable</strong> by name. If you run a ranking or shop system, expect people to impersonate each other's names to claim progress. Password-gating the things that matter is the only real defence.</li>
<li><strong>Bans by SteamID are weaker</strong> — a banned non-Steam player changes their name and returns with a new ID. Non-Steam servers lean harder on IP bans as a result; see your <a href="/plugins/csb-ban-manager">ban manager</a> for combining the two.</li>
<li><strong>Admin must be password-based</strong>, as above, because SteamID-only admin is trivially stolen.</li>
</ul>
<p>None of this is a reason not to accept non-Steam players — for most CS 1.6 communities it is where the audience is. It is a reason to build your admin, ban and stats systems assuming identity is weak, rather than discovering it the first time someone wears an admin's name.</p>