Steam Guard

🆕 Add / activate authenticator (maFile, both steps)

Generates a Steam mobile authenticator (maFile) — the full lifecycle in ONE endpoint. The step is auto-detected from the parameters (or force it with step: 1/2).

STEP 1 (add) — send username + password. If the account uses email Steam Guard, the first call returns HTTP 200 { "state": "NEED_EMAIL_CODE", "loginsession": "...", "nextrequest": {...} }; read the emailed code and call again with emailcode + loginsession. On success you get the maFile + accesstoken and Steam sends an SMS.

STEP 2 (finalize) — send sharedsecret + accesstoken (both from step 1) + activationcode (the code Steam sent, by SMS or email). Alternatively send the whole mafile + activationcode (sharedsecret/accesstoken are then read from it). smscode and emailcode are accepted as aliases for activationcode. The presence of sharedsecret, a mafile, or an activation code selects this step.

Works with or without a phone number: with a phone Steam sends the activation code by SMS, otherwise by email. Set mafiledownload to true (step 1) to receive the maFile as a downloadable <steamid>.maFile. IMPORTANT: store the revocation_code — it cannot be recovered.

post/steam/api/guard/add

Request

  • Base URL: https://www.steamwebapi.com
  • URL: https://www.steamwebapi.com/steam/api/guard/add
  • Auth: API key in query parameter key

Request body

usernamestring

Step 1.

passwordstring password

Step 1.

emailcodestring

Step 1 — email Steam Guard code (after the first call triggered it).

loginsessionstring

Step 1 — continuation token from the NEED_EMAIL_CODE response.

mafileobject

Step 2 (optional) — the whole maFile from step 1; sharedsecret + accesstoken are read from it automatically.

activationcodestring

Step 2 — the activation code Steam sent, by SMS if the account has a phone, otherwise by EMAIL. smscode and emailcode are accepted as aliases.

step'1' | '2'

Optional: force the step (1 = add, 2 = finalize).

mafiledownloadboolean

If true, respond with the maFile as a file attachment instead of JSON.

Response

Add (login): AWAITING_FINALIZATION — the maFile (with fully_enrolled already set to true so the saved file is final-ready), accesstoken, a mafiledownloadlink (a stateless data: URI that downloads the maFile) and mafilefilename (the <steamid>.maFile name to use with an <a download>) — or NEED_EMAIL_CODE (loginsession). Finalize: confirmation that the mobile authenticator is now active. With mafiledownload=true: the maFile as a file attachment.

Changes

No recorded changes to this operation across all 1 revision of this API.