@steamlab/steam-client

A lean TypeScript Steam client for Node.js. It handles the low-level CM connection, authentication, and message framing — giving you a clean foundation to build Steam integrations on top of.

Features

• Full TypeScript API with typed Steam protos
• QR code and credential login flows (with Steam Guard support)
• Logon via refresh token
• WebSocket transport to Steam CM servers
• HTTP, HTTPS, and SOCKS5 proxy support

Requirements

• Node.js >= 22
• npm >= 9.5.1

Installation

npm install @steamlab/steam-client

Quick Start

import { SteamClient } from "@steamlab/steam-client";
import type { ConnectionOptions } from "@steamlab/steam-client";

const options: ConnectionOptions = {
  steamCM: { host: "cmp1-iad1.steamserver.net", port: 27018 },
  timeout: 15_000,
};

const client = new SteamClient(options);

client.emitter.on("disconnected", (msg) => {
  console.log("Disconnected:", msg);
});

await client.connect();

Authentication

QR Login

The authentication-qr event fires with a challengeUrl. Render the QR code however you like — the client polls Steam in the background and resolves once the user scans it.

client.emitter.once("authentication-qr", ({ challengeUrl }) => {
  // Render challengeUrl as a QR code in your UI
  console.log(challengeUrl);
});

client.emitter.once("steam-auth-tokens", ({ tokens }) => {
  console.log("Refresh token:", tokens.refreshToken);
  console.log("Access token:", tokens.accessToken);
});

await client.services.authentication.loginViaQr();

Credential Login

Credential login is a two-step flow. Pass a Promise<string> as the second argument so the client can await a Steam Guard code if Steam requests one during sign-in. Resolve it with the device or email code when it becomes available.

// Listen for the type of guard required
client.emitter.on("authentication-2fa-required", ({ guardType }) => {
  // guardType: "device_code" | "email_code" | "device_confirmation" | "email_confirmation"
  console.log("Steam Guard required:", guardType);
});

client.emitter.once("steam-auth-tokens", ({ tokens }) => {
  console.log("Refresh token:", tokens.refreshToken);
  console.log("Access token:", tokens.accessToken);
});

// Use a promise to bridge the guard code from wherever it arrives
const { promise: codePromise, resolve: resolveCode } = Promise.withResolvers<string>();

const logonPromise = client.services.authentication.loginViaCredentials(
  { account_name: "your-username", password: "your-password" },
  codePromise,
);

// Supply the code when it arrives (e.g. from user input or your own service)
resolveCode("AB123");

await logonPromise;

Device and email confirmation types do not require a code — just approve the sign-in notification when it arrives in the Steam app or email.

Logon with Refresh Token

If you already have a valid refresh token from a previous session, you can skip the full auth flow:

await client.logonRequest({ access_token: refreshToken });

Connection Options

All options are passed to the SteamClient constructor.

| Option | Type | Required | Description | |---|---|---|---| | steamCM.host | string | Yes | CM server hostname | | steamCM.port | number | Yes | CM server port | | timeout | number | Yes | Connection timeout in milliseconds | | proxy | ProxyConfiguration | No | HTTP, HTTPS, or SOCKS5 proxy |

Proxy Example

import type { ConnectionOptions } from "@steamlab/steam-client";

const options: ConnectionOptions = {
  steamCM: { host: "cmp1-iad1.steamserver.net", port: 27018 },
  timeout: 10_000,
  proxy: {
    protocol: "socks5",
    host: "127.0.0.1",
    port: 1080,
    username: "user",   // optional
    password: "pass",   // optional
  },
};

Client API

| Method | Description | |---|---| | client.connect() | Connects to the Steam CM server | | client.disconnect() | Disconnects from the CM server | | client.logonRequest(payload) | Logs on using a refresh token | | client.startPlaying(gameId) | Reports a game as being played. Accepts bigint, number, string, or arrays of those values | | client.stopPlaying(gameId) | Stops reporting a game as being played. Accepts bigint, number, string, or arrays of those values |

Services

Services are available via client.services.

| Service | Description | |---|---| | client.services.authentication | QR and credential login flows | | client.services.player | Player-related Steam service calls. GetOwnedGames() is implemented; many generated player methods are not implemented yet |

At the moment, client.services.player.GetOwnedGames() is the main ready-to-use player helper:

const ownedGames = await client.services.player.GetOwnedGames();
console.log(ownedGames.games);

Events

Listen to events via client.emitter.

| Event | Payload | Description | |---|---|---| | disconnected | DisconnectMsg | Fired when the connection drops | | authentication-qr | { challengeUrl: string } | QR login URL ready to render | | authentication-2fa-required | { guardType: SteamGuardType } | Steam Guard code or confirmation needed | | steam-auth-tokens | { tokens: SteamAuthTokens } | Auth tokens received after login |

Exports

import {
  SteamClient,
  ProtoManager,
  EMsg,
  EResult,
  SteamEnums,
  ConnectionError,
  SteamClientError,
  SteamProtocolError,
  SteamProtocolEResultError,
} from "@steamlab/steam-client";

License

ISC — © steamlab-dev

Links

• GitHub
• npm Package