nickmura aka bobby

You need to provide the asset owner's SteamID as well. The linked repository only indicates that S is optional because you need either S or M (M is used for market listings).

logOff() is not async, no. But you're calling it before you're actually logged on, because you're calling it synchronously along with logOn().
A couple reasons why running steam-user serverless is a bad idea:
You can only log on once every 30 seconds because that's how frequently TOTP codes change Steam will start throttling your logon attempts, even if you don't have any failed logons Your request responses will take quite a long time with all the overhead of logging on each time