---
title: "🆕 Add / activate authenticator (maFile, both steps)"
method: POST
path: "/steam/api/guard/add"
tags: ["Steam Guard"]
---

# 🆕 Add / activate authenticator (maFile, both steps)

`POST /steam/api/guard/add`

## Request

- Base URL: `https://www.steamwebapi.com`
- URL: `https://www.steamwebapi.com/steam/api/guard/add`
- Auth: API key in query parameter `key`

Generates a Steam mobile authenticator (maFile) — the full lifecycle in ONE endpoint. The step is auto-detected from the parameters (or force it with `step`: 1/2).

STEP 1 (add) — send `username` + `password`. If the account uses email Steam Guard, the first call returns HTTP 200 `{ "state": "NEED_EMAIL_CODE", "loginsession": "...", "nextrequest": {...} }`; read the emailed code and call again with `emailcode` + `loginsession`. On success you get the maFile + accesstoken and Steam sends an SMS.

STEP 2 (finalize) — send `sharedsecret` + `accesstoken` (both from step 1) + `activationcode` (the code Steam sent, by SMS or email). Alternatively send the whole `mafile` + `activationcode` (sharedsecret/accesstoken are then read from it). `smscode` and `emailcode` are accepted as aliases for `activationcode`. The presence of `sharedsecret`, a `mafile`, or an activation code selects this step.

Works with or without a phone number: with a phone Steam sends the activation code by SMS, otherwise by email. Set `mafiledownload` to true (step 1) to receive the maFile as a downloadable `<steamid>.maFile`. IMPORTANT: store the revocation_code — it cannot be recovered.

## Request body

- object
  - `username` string: Step 1.
  - `password` string, password: Step 1.
  - `emailcode` string: Step 1 — email Steam Guard code (after the first call triggered it).
  - `loginsession` string: Step 1 — continuation token from the NEED_EMAIL_CODE response.
  - `mafile` object: Step 2 (optional) — the whole maFile from step 1; sharedsecret + accesstoken are read from it automatically.
  - `activationcode` string: Step 2 — the activation code Steam sent, by SMS if the account has a phone, otherwise by EMAIL. `smscode` and `emailcode` are accepted as aliases.
  - `step` '1' | '2': Optional: force the step (1 = add, 2 = finalize).
  - `mafiledownload` boolean: If true, respond with the maFile as a file attachment instead of JSON.

## Response `200`

Add (login): AWAITING_FINALIZATION — the maFile (with fully_enrolled already set to true so the saved file is final-ready), accesstoken, a mafiledownloadlink (a stateless data: URI that downloads the maFile) and mafilefilename (the <steamid>.maFile name to use with an <a download>) — or NEED_EMAIL_CODE (loginsession). Finalize: confirmation that the mobile authenticator is now active. With mafiledownload=true: the maFile as a file attachment.

## Other responses

- `402`: Requires Trade API access — shares the "trade" rate limit.
- `409`: The account already has an authenticator.
- `422`: Validation failed, or the email/activation code was required or rejected.
- `502`: Steam rejected the request.
- `503`: Steam unreachable.

---

[API](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation.md) · [All operations](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/llms.txt) · [OpenAPI document](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/revisions/f9a4109cbda6?raw)