01The coordinates — what you're pointing at
App / AppID
The product. Every game, server, demo, DLC and tool on Steam is an "app" with a numeric AppID — TF2 is 440, its dedicated server is a separate app, 232250. It's the one mandatory coordinate in every DepotDownloader command, findable in any store URL or on SteamDB.
Depot / DepotID
A sealed container of files inside an app — the unit Steam actually stores and ships. Apps split content across depots by role: a big platform-agnostic asset depot, small per-OS binary depots, per-language audio depots (CS:GO's split is a vivid example). Each has its own DepotID and its own history.
Manifest / Manifest ID
A snapshot of one depot's complete file list at one moment, addressed by a 64-bit ID. Every build ever shipped left one behind, which is what makes version time-travel addressable. The single most important concept on this site — the deep dive takes it apart fully.
Build ID
A small, incrementing number identifying an app-wide build — a bundle of manifest references across depots. Useful for reading SteamDB history; not a download coordinate. The classic beginner trap is pasting a Build ID into -manifest — DepotDownloader wants the long manifest ID from the depot's Manifests tab, not this.
Branch (beta)
A named pointer to a build — public is the default one, and developers can run others: betas, staging, legacy snapshots like CS:GO's csgo_legacy. Reached with -branch (password-protected ones add -branchpassword). Branches matter doubly since 2025: manifests referenced by an active branch still get request codes reliably, making them the dependable downgrade path.
02Ownership & access — what you're allowed
License / Package
What "owning a game" technically is: your account holds a license to a package, which bundles one or more apps and their depots. Depot access checks this chain on every download — which is why family-shared games (a borrowed license, not yours) don't work, and why one license covers every platform and language of a game.
Anonymous account
A real Steam account with no credentials that anyone may log in as — and which genuinely owns things: released dedicated servers and free apps land in its package automatically. The backbone of server workflows. Its limits: nothing paid, and a deliberately trimmed view of manifest history.
Depot key
The per-depot encryption key that decrypts chunks. Steam hands it over only to accounts licensed for the depot — this, not the download itself, is where piracy dies. "Depot key denied" style failures are license problems, not connectivity ones.
Manifest request code
A short-lived token Steam must issue before the CDN serves a manifest, checked per-account and per-manifest. When Steam declines — old unreferenced manifests, post-2025 policy — the download 401s and no tool can fix it. The mechanism behind the site's status page and the 401 diagnostic.
Steam Guard
Steam's two-factor system, in email and mobile-app flavours. DepotDownloader triggers it like any new device: confirm a push, or type a code (-no-mobile forces the typed path). Its error codes have their own decoder.
Refresh token
The revocable credential -remember-password actually stores (never the password) in account.config. Lets later runs skip the password and Steam Guard entirely; dies on password change or "deauthorize all devices". The full story: authentication docs.
03Delivery machinery — how bytes move
SteamPipe
The HTTP-based content system Steam has run since 2013 — the architecture that introduced depots-as-chunks-on-CDN and made tools like DepotDownloader possible. When this site says "the Steam content system", it means SteamPipe.
Chunk
The atomic unit of storage: files are sliced into ~1 MB pieces, compressed (zstd in current Steam, supported by DepotDownloader since 3.4.0), encrypted with the depot key, and addressed by content hash — so identical chunks are stored and downloaded once, across files and even across builds.
CDN / content server
The global fleet of cache servers that actually serve chunks and manifests over plain HTTP(S). Which one you talk to varies — and so does its mood; "slow download" is almost always CDN luck, not the tool. DepotDownloader remembers misbehaving servers between runs.
Cell ID
Steam's numeric code for a network region, used to pick nearby content servers. Auto-detected; -cellid overrides it when your nearest node is having a bad week.
Delta patching
The reason updates are fast: a new manifest is compared chunk-by-chunk against what's on disk, and only missing chunks download. It's why re-running the same command is the update mechanism, and why a no-change cron check costs seconds. Mechanics: manifests deep dive.
Validation
Re-hashing every local file against the manifest and replacing whatever doesn't match (-validate). A repair tool and a diff tool in one — with the sharp edge that on modded installs it "repairs" the mods away. Both faces documented in the Rust guide.
04The neighbours — related, often confused
appmanifest_*.acf
The Steam client's local bookkeeping file in steamapps/ — install state, update policy. Not a depot manifest, despite the name; this collision causes endless confusion. You'll meet it when convincing the client not to update a downgraded game; DepotDownloader itself never touches it.
Workshop
Steam's mod-and-maps distribution layer, built on UGC. Items are downloadable by ID without the client — the workshop guide covers it — with one structural caveat: no version history, current version only.
PublishedFileId
A workshop item's public identity — the number after ?id= in its URL, fed to -pubfile. Resolves internally to a UGC handle.
UGC / UGC ID
"User-generated content" — the raw storage handle beneath workshop items, occasionally met directly in API responses and old Source-engine references. -ugc downloads by it when you have the handle instead of the URL.
SteamKit2
The open-source .NET library that re-implements Steam's network protocol — the engine inside DepotDownloader, built by the same SteamRE community. When you log in, it's SteamKit2 performing the same handshake the official client does; a load-bearing fact for the safety story.
GSLT
Game Server Login Token — the credential a running dedicated server uses to list itself publicly. Included here as a boundary marker: it belongs to server operation, not content download. If your files arrived but the server won't list, you've left this site's jurisdiction.
Missing a term you came here for? The manifests deep dive and how it works cover the system in prose rather than dictionary form — and if it's missing everywhere, the discussions board is where vocabulary gets coined.