Set Up SentinelID on Your Server
The SentinelID sidecar is a lightweight Python service that runs alongside your game server. It verifies player devices and manages the server whitelist via RCON.
Prerequisites
SentinelID publisher account
Register at the dashboard to get your Publisher ID and API key.
Go to DashboardPython 3.11+
The sidecar runs as a Python process alongside your game server. 3.11 is the floor because it needs tomllib.
Metamod:Source and CounterStrikeSharp
The SentinelID plugin runs on CounterStrikeSharp, which loads under Metamod. It handles the grace period and enforcement in-game.
CounterStrikeSharp docsRCON enabled
CS2 speaks classic Source RCON over TCP, on the same port as the game. Launch with -usercon and set rcon_password on the command line.
Counter-Strike 2 Setup
Two pieces: a sidecar that talks to the SentinelID API, and a CounterStrikeSharp plugin that enforces on connect. CS2 has no native whitelist, so all enforcement lives in the plugin.
- 1
Install Metamod:Source and CounterStrikeSharp
The plugin loads under CounterStrikeSharp, which loads under Metamod. Install both before anything else.
Metamod needs a search path entry in
csgo/gameinfo.gi. Note where it goes: every CS2 update rewrites that file and drops the line, which stops the whole chain loading with no error to tell you. Re-adding it is the first thing to check when verification stops working. - 2
Download the sidecar
Download the CS2 sidecar package and extract it to your server.
Download CS2 Sidecar - 3
Build and install the plugin
The plugin is a CounterStrikeSharp module. Build it from source and drop the output in
Download the plugin sourceaddons/counterstrikesharp/plugins/SentinelID/. - 4
Configure config.toml
Edit
config.tomlwith your SentinelID credentials, RCON settings, and admin API key. See the config reference below.Set
admin_api_keyto a long random string and put the same value in the plugin'sAdminApiKey, or in-game!sid banwill be refused. - 5
Start CS2 with RCON enabled
CS2 speaks classic Source RCON over TCP, on the game port. Both flags have to be on the command line, not only in server.cfg:
-dedicated -usercon +rcon_password "YOUR_PASSWORD"The plugin kicks unverified players after a configurable grace period. Leave
KickUnverifiedfalse to watch what it would have done without removing anyone. - 6
Install dependencies and run
pip install -r requirements.txtpython sidecar.pyNeeds Python 3.11 or newer. Confirm it is up with
curl localhost:7997/status. - 7
Open firewall ports
Players and the admin panel need to reach the sidecar:
- Port
7997TCP — sidecar (companion + admin panel) - Port
27015UDP — CS2 game traffic - Port
27015TCP — RCON (keep local-only unless needed)
- Port
- 8
Set up the admin panel
Download the Admin Panel (single HTML file). Open it in any browser, enter your sidecar URL and admin API key, and you can view connected players, ban devices, and look up Steam IDs from anywhere.
- 8
Verify
Check the sidecar is running:
http://YOUR_SERVER_IP:7997/statusshould return{"status":"ok"}.
Config reference
All parameters in config.toml.
| Parameter | Description | Example |
|---|---|---|
| sentinel_api_key | Your API key from the SentinelID dashboard | sni_live_... |
| sentinel_publisher_id | Your publisher ID | pub_xxx |
| sentinel_game_id | The game ID you registered | game_xxx |
| rcon_host | RCON host (usually localhost) | 127.0.0.1 |
| rcon_port | RCON port. For CS2 this is the game port, not a separate one | 27015 |
| rcon_password | Your server's RCON password | — |
| auth_ttl_seconds | How long a player stays whitelisted before needing to re-authenticate | 3600 |
| listen_port | Port the sidecar listens on for companion connections | 7997 |
| mode | "enforcing" (RCON kicks are executed) or "permissive" (logged only). Separate from the plugin's own KickUnverified switch | enforcing |
| admin_api_key | Required for /ban, /unban and /players, and for in-game !sid ban. Leave it empty and those are refused outright. Put the same value in the plugin's AdminApiKey | your-strong-random-key |
| auth_store_path | File path for persisting auth state across sidecar restarts | auth_store.json |
Troubleshooting
Everything stopped verifying after a CS2 update
Check this first. Every CS2 update rewrites gameinfo.gi and silently drops the Metamod search path, so Metamod, CounterStrikeSharp and the plugin all stop loading with no error. Re-add it, then confirm with meta list and css_plugins list.
Companion can't connect to sidecar
Ensure port 7997 (or your configured listen_port) is open in your firewall and forwarded if behind NAT. Players connect to it directly, so it has to be reachable from the internet.
RCON connection refused
CS2 needs -usercon on the command line and rcon_password set there too, not only in server.cfg. The RCON port is the game port, usually 27015.
SentinelID API returns 401
Your API key is invalid or expired. Generate a new one from the dashboard.
Players can join without being verified
CS2 has no native whitelist, so nothing blocks a connection on its own. Enforcement lives in the plugin: check it is loaded with css_plugins list, and that KickUnverified is true in its config.
In-game !sid ban returns 401 or 403
Set admin_api_key in the sidecar config and the identical value as AdminApiKey in the plugin config. An empty key means those endpoints refuse every request, which is deliberate: the sidecar listens on 0.0.0.0 and an empty key used to mean no key was needed at all.
Register your server
Once your sidecar is running, submit your server details below. After review, your server will appear in the companion app so players can find and authenticate with it.