shared_secret changing when first logging into mobile app after enabling two factor?

[spock]

I'm using steam-totp to automate logging in like so...  and it's prompting me for a steam guard code:

user.logOn({
    accountName: 'user',
    password: 'pass',
    twoFactorCode: SteamTotp.generateAuthCode(this.shared_secret)
});

I first used 

user.createAccount()

Then I used

user.enableTwoFactor()

and saved the response from calling enable two factor.

{ shared_secret: '***',
  serial_number: '***',
  revocation_code: '***',
  uri: '***',
  server_time: '***',
  account_name: 'user',
  token_gid: '***',
  identity_secret: '***',
  secret_1: '***=',
  status: 1 }

I then finalized my two factor 

user.finalizeTwoFactor(shared_secret, smsCode)

After this I logged into the steam mobile app - it prompted me for a steamguard code... so i clicked send SMS code to use this device and when I entered the code it allowed me to log into the steam mobile...

 

I have a feeling that this overrode my enableTwoFactor details I saved earlier...

 

Can anybody comment on this?

 

[Dr. McKay]

Your device's clock is probably wrong.

[spock]

It works with another account I have that I pulled the shared secret from my phone. I'll try the offset

 

edit: didn't have an offset. 

 

I'll check my shared secret on my phone and see if they match with what was generated with enableTwoFactor

Edited June 15, 2017 by spock

[spock]

So the codes are different. I tried disabling two factor on my phone and re-ran the steps I mentioned above and it worked.

 

It appears if I want to have twoFactor enabled on my phone I need pull my shared and identity secret off my phone. Does this make sense?

[Dr. McKay]

Correct. You can't get new secrets from Steam without disabling and re-enabling.

[spock]

Correct. You can't get new secrets from Steam without disabling and re-enabling.

 

Thanks very much!

Edited June 16, 2017 by spock