Dr. McKay

The only receivedOfferChanged notification is for an active received offer going into another state (decrement of "pending active offers" notification count). 5 seconds should be okay.

As of v1.20.0, you can pass your own SteamCommunity to the constructor of TradeOfferManager. You can pass your own request to the SteamCommunity constructor and you can specify a proxy to request via request.defaults.

Using the Steam client is the fastest way to get notifications, but you still need polling to make sure you get everything (Steam doesn't send notifications when offers you send in which you receive no items are accepted, for example). Polling every second is overkill, but is possible.

That's a known Steam issue. Some confirmations just aren't shown by Steam.

https://github.com/MrJohz/appdirectory/issues

Yes.

I think I'm also going to change how poll data saving/restoration works, making it a string instead of an object, removing the need to JSON.stringify and JSON.parse.

Deploying from GitHub is a bad idea; use npm instead.

Nobody can really help without seeing your code.

newOffer isn't emitted for sent offers. Also, please update to the latest version.

Read the documentation. Specifically you need to save the steamguard value from the callback of login and provide it to subsequent calls to login.

Reposting this as I would like some feedback if anyone has it. At this point I like the trade URL idea enough that I'm potentially willing to just accept the risks and put a big bold warning in the docs.

Good catch, that's indeed a bug. Fixed in v1.20.2. Were you on the beta version when you first made this thread?

You have no options with steam-tradeoffer-manager. There might be some modules that scrape the HTML instead, but you're in for a really bad time if you try that. I don't know what it's called or if it's maintained.

You use node-steam-totp to generate a login code from your shared_secret, and pass it to node-steamcommunity's login method as twoFactorCode.

That really doesn't have any place in this module.

Yes, that's the best (and only) way to do it. You need an API key if you want to use the WebAPI. Based on your error message I assume that you're using steam-tradeoffer-manager, which does need an API key and consequently won't work with limited accounts. So yes, you'll need to spend $5 per bot.

Your own account? Or someone else's account? If you want games someone else owns, there's a WebAPI method for that.

I don't know an awful lot about CS:GO, but I know that you can't inspect any tools. I don't know if there are any skins that can't be inspected.

https://httpstatuses.com/500 500 just means Steam is broken and you'll have to try again later. There isn't anything you can do.

1. Calling login() again with your username and password is guaranteed to renew your session (unless Steam is having problems). The oAuthLogin method is supposed to do this, but I believe it doesn't work 100% as expected. 2. There isn't any event. Currently you just have to check loggedIn every so often. The next update will most likely add such an event.

You can't inspect stickers.

Just pass true for that argument, and in the callback the items will have an actions array defined and populated with the inspect link (and any other applicable actions).

I just thought of a potential issue with using just the trade URL. Presently you have to construct an offer using a SteamID explicitly. Getting the ID from the URL opens sloppy implementations to the potential for users to send offers to other users. For example, a typical implementation currently has a user sign in through Steam's OpenID, then prompts the user for their trade URL. Both of these are sent to the bot. The offer is created using the authenticated SteamID, and the token is extracted from the URL. If the trade URL isn't for that user's account, the offer just fails. With the proposed new API, a user could enter someone else's trade URL. If the implementation doesn't check offer.partner, then unrelated users could receive unsolicited offers. Of course, we could add a note to the documentation to check offer.partner when you use a trade URL, but I don't really like the loss of the built-in safeguard.

The way I generally do it is set up a bot in node.js using steam-tradeoffer-manager, and create a Web server in that bot which accepts commands to send trade offers. Then use curl in php to command the bot to send an offer. I believe there are php libraries for interacting with Steam, but I don't personally think php is well suited for that task.