01Why this always works
There's actual machinery behind the magic, and it's worth thirty seconds to understand. When a developer releases a dedicated server through Steamworks, the server's AppID gets added to the anonymous account's license package automatically — Valve's own docs describe server apps being folded into the anonymous SteamCMD package (pkg 17906) on release. In other words, the account you log into with no credentials genuinely owns every released server app. That's why no -username, no Steam Guard and no purchase ever enters the picture: you're not bypassing a license check, you're passing one.
It's also why this is the workflow where DepotDownloader most clearly beats babysitting the Steam client: a server box has no GUI, the download is a one-liner, and the same line runs in cron, CI or a Dockerfile unchanged.
02The generic recipe
Three decisions: which app, which OS, which folder.
$ ./DepotDownloader -app 258550 -os linux -dir /srv/rustSwap the AppID from the table below and that's the entire tutorial. The flags that matter here: -os because you're often downloading on one machine for another (grab the Linux build from your Windows desktop, or vice versa); -dir because you want the files where the server runs, not in a default folder; and -validate when re-running over an existing install to repair rather than re-fetch. Test builds live behind -branch — most server apps keep a staging or beta branch in the open. Every flag's full story is in the CLI reference.
How to find an AppID that isn't in my table: search SteamDB for "game name dedicated server". The server is almost always its own free app with its own ID — distinct from the game — and SteamDB's app page tells you immediately whether anonymous works (look for the ADD-ON / free license type). The one big modern exception: Counter-Strike 2 merged client and server into app 730, so the "server app" is the game app, anonymous still fine — just expect a client-sized download.
03The AppID table
| Game | Server AppID | Anonymous? | Notes |
|---|---|---|---|
| Rust | 258550 | YES | Full walkthrough: clean Rust server — staging branches, rollback, -validate reset. |
| Counter-Strike 2 | 730 | YES | Merged with the client app — ~60 GB, includes the game. |
| Team Fortress 2 | 232250 | YES | The classic SRCDS family — full guide: TF2 & HLDS. |
| Garry's Mod | 4020 | YES | Pair with workshop downloads (-pubfile) for addons and maps. |
| Left 4 Dead 2 | 222860 | YES | Same SRCDS pattern as TF2. |
| Valheim | 896660 | YES | No GSLT needed at all. |
| Project Zomboid | 380870 | YES | Server build trails game updates occasionally — check the beta branches. |
| Palworld | 2394010 | YES | Full walkthrough with version-pinning: Palworld servers & downgrades. |
| Satisfactory | 1690800 | YES | |
| ARK: Survival Evolved | 376030 | YES | Big — filelists help if you only need to refresh binaries. |
| 7 Days to Die | 294420 | YES | Version-sensitive community — archive builds you care about. |
| CS:GO (legacy) | 740 | YES | The classic server lives on — full story in CS:GO after CS2; older manifests increasingly gated. |
A row missing here doesn't mean it won't work — it means I haven't personally verified it recently. The SteamDB search above answers any game in under a minute, and the recipe doesn't change. The same anonymous-pull logic has a client-side cousin for the games that allow it: pulling a clean Rust client straight from the CDN follows the identical pattern, with EAC and license caveats layered on top.
04Updating on a schedule
The trick is that there is no trick: re-running the same command is the update. DepotDownloader diffs the manifest against what's on disk and only downloads changed chunks — the mechanics are in the manifests deep dive — so a no-op update costs seconds, not gigabytes. A serviceable cron job is just:
# /etc/cron.d/rust-update — check for updates nightly at 04:10
10 4 * * * steam /opt/depotdownloader/DepotDownloader -app 258550 -os linux -dir /srv/rust >> /var/log/rust-update.log 2>&1Stop the game server before the run if the game holds file locks, and start it after. (Pipelines, Docker and failure handling get their own page: automation docs.) Two cautions from the field, one of which I learned by factory-resetting my own modded server once: don't add -validate to the scheduled job if the server is modded — validation restores every stock file and will quietly factory-reset Oxide or similar frameworks on every run (the Rust guide covers this cut-both-ways behaviour); and don't schedule more aggressively than the game updates — nightly is plenty, and Steam's CDN doesn't owe anyone a hammering.
05When it breaks anyway
Two failure modes cover nearly every report. First: downloading the latest build always works, but old server manifests are no longer exempt from the request-code gating — anonymous sessions see even less history than logged-in ones, and some server depots have refused codes for older builds since the 2025 tightening. If you're pinning a server to a past version and hit a 401, walk the diagnostic tree and check the status page; the rollback that still works reliably is the recent-manifest case, not deep history.
Second, a scoping note that saves confusion: DepotDownloader gets the files onto disk, and that's where its job ends. Game Server Login Tokens (GSLT), server visibility, ports and the actual running of the thing are between you and the game's own documentation — if the files arrived and the server won't list publicly, nothing on this site is the culprit.