steam-auth-nodejs

Steam Mobile Authenticator for Node.js. Generate Steam Guard codes (2FA/TOTP), link or remove a mobile authenticator, and fetch/accept/deny mobile trade & market confirmations.

This is a Node.js port of the C# SteamAuth library.

⚠️ Use responsibly. This library handles sensitive account secrets (shared_secret, identity_secret, refresh tokens). Never commit them to source control or share them. You are responsible for complying with Steam's Subscriber Agreement.

Installation

npm install steam-auth-nodejs

Requires Node.js >= 16. The only runtime dependency is axios.

Quick start

Generate a Steam Guard code

If you already have a maFile (exported from SteamDesktopAuthenticator or after linking with this library):

const { SteamGuardAccount, TimeAligner } = require('steam-auth-nodejs');
const fs = require('fs');

(async () => {
  // Align local clock with Steam's servers (recommended before generating codes)
  await TimeAligner.alignTimeAsync();

  const account = SteamGuardAccount.fromJSON(
    JSON.parse(fs.readFileSync('./account.maFile', 'utf8'))
  );

  const code = await account.generateSteamGuardCodeAsync();
  console.log('Steam Guard code:', code);
})();

generateSteamGuardCode() is also available synchronously if the time is already aligned.

API

SteamGuardAccount

Represents a linked authenticator. Fields map to the standard maFile format.

| Method | Description | | --- | --- | | static fromJSON(json) | Build an account from a maFile object or JSON string. | | toJSON() | Serialize back to the maFile format. | | generateSteamGuardCode() | Generate the current 2FA code (sync, uses last aligned time). | | generateSteamGuardCodeAsync() | Generate the current 2FA code, aligning time first if needed. | | generateSteamGuardCodeForTime(time) | Generate a code for a specific Unix timestamp. | | fetchConfirmationsAsync() | Fetch pending mobile confirmations. Returns Confirmation[]. | | acceptConfirmation(conf) / denyConfirmation(conf) | Accept/deny a single confirmation. | | acceptMultipleConfirmations(confs) / denyMultipleConfirmations(confs) | Bulk accept/deny. | | deactivateAuthenticator(scheme?) | Remove Steam Guard. 1 = return to email codes, 2 = remove completely. |

Confirmations example

const account = SteamGuardAccount.fromJSON(myMaFile);

const confirmations = await account.fetchConfirmationsAsync();
for (const conf of confirmations) {
  console.log(conf.headline, conf.confType);
  await account.acceptConfirmation(conf);
}

conf.confType is one of EMobileConfirmationType (Trade, MarketListing, …).

SessionData

Holds the Steam session tokens (steamID, accessToken, refreshToken, sessionID) and builds the cookies used for confirmation requests.

const { SessionData } = require('steam-auth-nodejs');

const session = new SessionData();
session.steamID = '7656119...';
session.accessToken = '...';
session.refreshToken = '...';

if (session.isAccessTokenExpired()) {
  await session.refreshAccessToken();
}

AuthenticatorLinker — linking a new authenticator

const { AuthenticatorLinker, LinkResult, FinalizeResult } = require('steam-auth-nodejs');

const linker = new AuthenticatorLinker(session);
linker.phoneNumber = '+1XXXXXXXXXX'; // only if the account has no verified phone

const result = await linker.addAuthenticator();
if (result === LinkResult.AwaitingFinalization) {
  // linker.linkedAccount now holds the maFile — SAVE IT before finalizing
  fs.writeFileSync('account.maFile', JSON.stringify(linker.linkedAccount.toJSON()));

  const smsCode = '...'; // code Steam texted to the phone
  const finalize = await linker.finalizeAddAuthenticator(smsCode);
  console.log(finalize === FinalizeResult.Success ? 'Linked!' : finalize);
}

LinkResult, PhoneLinkResult and FinalizeResult are exported as enum-like objects of string constants.

TimeAligner

| Method | Description | | --- | --- | | alignTimeAsync() | Sync the offset with Steam's time servers. | | getSteamTime() | Current Steam time (Unix seconds, sync). | | getSteamTimeAsync() | Current Steam time, aligning first if needed. | | resetAlignment() | Force re-alignment on the next call. |

Exports

const {
  SteamGuardAccount,
  AuthenticatorLinker,
  SessionData,
  TimeAligner,
  SteamWeb,
  Confirmation,
  ConfirmationsResponse,
  EMobileConfirmationType,
  LinkResult,
  PhoneLinkResult,
  FinalizeResult,
  APIEndpoints,
} = require('steam-auth-nodejs');

TypeScript type definitions are bundled (index.d.ts).

License

MIT