here is easy fix:
const request = require('request');
const SteamCommunity = require('steamcommunity');
let community = new SteamCommunity({
request: request.defaults({
headers: {
'Accept-Encoding': 'gzip, deflate, br'
}
})
});
if you use proxy:
request: request.defaults({
proxy: proxyUrl,
headers: {
'Accept-Encoding': 'gzip, deflate, br'
}
})
This is not rate limiting. Steam's WAF now fingerprints the Accept-Encoding request header. The legacy request package (which node-steamcommunity uses internally with gzip: true) sends exactly Accept-Encoding: gzip, deflate — real browsers always include br as well. Steam now rejects the bot-like values outright:
Accept-Encoding sent
Response
gzip, deflate (request lib default)
429
gzip
429
gzip, deflate, br
200
gzip, deflate, br, zstd
200
Same IP, same endpoint, seconds apart — only the header changes the outcome. api.steampowered.com is not affected.
