All Activity

I'm having the exact same issue. Polling randomly starts getting 429 from time to time and getUserDetails gets heavily rate-limited out of nowhere on some of my accounts. Currently I only have 2 bad solutions: 1) Skip the getuserdetails (tradehold) check if 429 appears. 2) Rotate proxies. (This gets your account locked by steams support though) They also started rate-limiting/banning a lot of residential proxies heavily. I can't even access inventories/market from some IPs for days. edit: Actually this is possibly related to having a "bad ip" (an IP that Steam doesn't like) because I just tried using a proxy with an IP from my bot that is getting 429 on getUserDetails and I can't even access https://steamcommunity.com/market/, it says too many requests, try later. Sending offers & getting trade offers thru the bot works tho.

Having similar issue when logging in my accounts with refreshtokens, sometimes it stucks and i dont get any response in any possible events like "error" "disconnected", "loggedOn" debug after stuck looks like (could be wrong lines but anyway) [W189861] WebSocket closed by remote with code 1000 and reason "" [W189861] Handling connection close Disconnecting Sending message: ClientLogOff Disconnecting without sending logoff [W189861] We wanted to end connection, but it's not connected or connecting Disconnecting [W189859] We wanted to end connection, but it's not connected or connecting [W189859] We wanted to end connection, but it's not connected or connecting Disconnecting [W189860] We wanted to end connection, but it's not connected or connecting [W189860] We wanted to end connection, but it's not connected or connecting Disconnecting [W189861] We wanted to end connection, but it's not connected or connecting [W189861] We wanted to end connection, but it's not connected or connecting webCompatibilityMode is true, with false is the same

I need a function for quickly selecting passwords for family sharing

mea culpa, I've forgotten to thank you for this advice, thank you, it helped

It appears Steam has introduced new dynamic rate limits which change during time of day and affect getTradeOffers and similar endpoints. The rate limits start up at around 9AM and they last till like 6PM UTC+0. It's still fine though, most requests (90%) appear to go through and overall is not a massive problem. But I've noticed a new more persistent rate limit on the TradeOffer.getUserDetails endpoint. This appears to happen - (perhaps) after trying to fetch a non-working Trade URL - and then persistently for a long time you're getting 429s (hour/s). I'm not sure if the wrong trade URL fetch is the cause as that seems silly, but that's what I've heard from others -> perhaps someone has experimented with this and is willing provide more details?

Fixed webLogOn retry timer not being cleared when connection ends (thanks to @Sadzurami in #516) Fixed WebSocket disconnections not being properly flagged internally (thanks to @Sadzurami in #500) Full Changelog: v5.2.0...v5.2.1 View on GitHub

Updated docs to reflect changes to getWebCookies(), renewAccessToken(), and renewRefreshToken() when using EAuthTokenPlatformType.SteamClient Added retries when errors encountered when calling getWebCookies() for EAuthTokenPlatformType.WebBrowser Full Changelog: v1.9.2...v1.9.3 View on GitHub

Seems like a backend change that access token refreshes for SteamClient tokens are authenticated now. I've updated the docs to reflect it: https://github.com/DoctorMcKay/node-steam-session?tab=readme-ov-file#refreshaccesstoken

I just sent you a telegram but you blocked me. I want to know what happened.

Yes, I also encountered this problem.

It returns error response AccessDenied.

You've got some problem with your proxy being unable to connect to Steam, it seems.

Thank you so much for your help and proposed fix, but unfortunately it still doesn’t work in my case. I've focused on httpProxy this time. Below are the details. Output: Code: const SteamUser = require("steam-user"); const SteamTotp = require("steam-totp"); // ––– your 2FA & creds (censored) ––– const sharedSecret = "*****"; const accountName = "*****"; const password = "*****"; // proxy must start with "http://" const httpProxy = "http://*****:*****@*****:8000"; const client = new SteamUser({ httpProxy, webCompatibilityMode: true, // protocol: SteamUser.EConnectionProtocol.TCP, // uncomment to force raw‑TCP }); client.logOn({ accountName, password, twoFactorCode: SteamTotp.generateAuthCode(sharedSecret), }); client.on("loggedOn", () => { console.log("✅ Logged in – Steam sees IP as", client.publicIP); }); client.on("error", (err) => { console.error("❌ Login error:", err); }); Proxy test:

The string you pass to httpProxy needs to start with http:// createConnection is not a valid option for the SteamUser constructor. To use a SOCKS proxy, you should use the socksProxy option.

Describe the bug When attempting to log in to Steam using a proxy, Steam still sees my real IP address instead of routing traffic through the proxy. I have tried both HTTP‐over‐HTTP (httpProxy) and SOCKS5 (createConnection + SocksProxyAgent) approaches in two separate test files, but neither one works as expected. Versions - steam-user: v5.2.0 - steam-totp: v2.1.2 - socks-proxy-agent: v8.0.5 - Node.js: v22.14.0 - OS: Windows 11 Screenshots and Error Logs When running either test file, login succeeds but `client.publicIP` reports my real IP, not the proxy’s IP: No other errors are thrown. http.js const SteamUser = require("steam-user"); const SteamTotp = require("steam-totp"); // ––– your 2FA & creds ––– const sharedSecret = "ABCDEFGH1234IJKL="; const accountName = "myUserName"; const password = "MyP@ssw0rd!"; // just “user:pass@host:port” (percent‑encode any “=” or “@” in your password) const httpProxy = "user123:pa%40ssw0rd%[email protected]:8080"; const client = new SteamUser({ httpProxy, webCompatibilityMode: true, // you can force raw‑TCP if you like: // protocol: SteamUser.EConnectionProtocol.TCP }); client.logOn({ accountName, password, twoFactorCode: SteamTotp.generateAuthCode(sharedSecret), }); client.on("loggedOn", () => { console.log("✅ Logged in – Steam sees IP as", client.publicIP); }); client.on("error", (err) => { console.error("❌ Login error:", err); }); socks5h.js const SteamUser = require("steam-user"); const SteamTotp = require("steam-totp"); const { SocksProxyAgent } = require("socks-proxy-agent"); //––– your 2FA & creds ––– const sharedSecret = "ABCDEFGH12345678="; const accountName = "exampleUser"; const password = "Tr1ckyP@ss"; // your socks5h URL: const socksUri = "socks5h://fake-user:[email protected]:1080"; const agent = new SocksProxyAgent(socksUri); const client = new SteamUser({ // force raw‐TCP protocol: SteamUser.EConnectionProtocol.TCP, // whenever steam-user wants a socket, we hand it over to our proxy agent createConnection: (opts) => agent.createConnection(opts), autoRelogin: true, }); client.logOn({ accountName, password, twoFactorCode: SteamTotp.generateAuthCode(sharedSecret), }); client.on("loggedOn", () => { console.log("✅ Logged in – Steam sees IP as", client.publicIP); }); client.on("error", (err) => console.error("❌ Login error:", err));

Thanks...I managed to figure out the problem. For other's future reference, disabling "Steam Authenticator" on your phone is not enough and you will need to go to Steam on browser to turn off Steam Guard entirely.

It may not be enabled on that phone, but it's enabled somewhere.

But I don’t, this is my steam account from “Steam Guard” page on my mobile showing my 2 account. With steam guard enabled there will be a blue checkmark, without it there will be a plus shield icon. I explicitly did “Remove Steam Authenticator” on my mobile settings before using this library.

Thank you for your help! I should look into it a bit more — it's most likely something I did wrong. Thanks again for your assistance! Wishing you a wonderful day.

Dunno, you're doing something wrong then.

Here is some information from my refresh_token. I believe it hasn't expired yet, since I've recently logged in again using Steam Desktop Authenticator. Payload: { "iss": "", "sub": "", "aud": [ "web", "renew", "derive" ], "exp": 1762718905, "nbf": 1735992415, "iat": 1744632415, "jti": "", "oat": 1744632415, "per": 1, "ip_subject": "", "ip_confirmer": "" }

I'd guess your refresh token is probably expired or now invalid.

Using steamRefresh_steam from login post Response Headers Set-Cookie is the same. https://login.steampowered.com/jwt/finalizelogin {"response":{}}

Thank you! The refresh_token comes from the maFile generated by linking with Steam Desktop Authenticator. This is Steam Desktop Authenticator:

You clearly already have MFA enabled if it's asking for an MFA code.