Berlioz

here is easy fix:
const request = require('request'); const SteamCommunity = require('steamcommunity'); let community = new SteamCommunity({ request: request.defaults({ headers: { 'Accept-Encoding': 'gzip, deflate, br' } }) }); if you use proxy:
request: request.defaults({ proxy: proxyUrl, headers: { 'Accept-Encoding': 'gzip, deflate, br' } })  
This is not rate limiting. Steam's WAF now fingerprints the Accept-Encoding request header. The legacy request package (which node-steamcommunity uses internally with gzip: true) sends exactly Accept-Encoding: gzip, deflate — real browsers always include br as well. Steam now rejects the bot-like values outright:
Accept-Encoding sent Response gzip, deflate (request lib default) 429 gzip 429 gzip, deflate, br 200 gzip, deflate, br, zstd 200 Same IP, same endpoint, seconds apart — only the header changes the outcome. api.steampowered.com is not affected.

Fixed corrupted Steam data possibly overwriting inventory item assetids Full Changelog: v3.48.7...v3.48.8
View on GitHub

Update package to latest version and add useAccessToken: true to your constructor
 
const manager = new TradeOfferManager({ steam: client, community: community, language: "br", useAccessToken: true  });

Steam is no longer issuing login keys. steam-user 4.28.0 adds a hack that makes login key code work without any changes, but using login keys is now officially deprecated.