---
title: "🔐 Generate a Steam Guard login code"
method: POST
path: "/steam/api/guard/code"
tags: ["Steam Guard"]
---

# 🔐 Generate a Steam Guard login code

`POST /steam/api/guard/code`

## Request

- Base URL: `https://www.steamwebapi.com`
- URL: `https://www.steamwebapi.com/steam/api/guard/code`
- Auth: API key in query parameter `key`

Generates the current 5-character Steam Guard login code (TOTP) from a sharedsecret — the same code the Steam mobile app shows. Stateless: the secret is supplied in the body and never stored.

## Request body

- object
  - `sharedsecret` string, password, required
  - `steamid` string: Optional, only used to derive a device id.
  - `deviceid` string

## Response `200`

Current Steam Guard code with expiry information.

## Other responses

- `402`: Requires Trade API access — shares the "trade" rate limit.
- `421`: Missing or invalid JSON body.
- `422`: Validation failed.

---

[API](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation.md) · [All operations](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/llms.txt) · [OpenAPI document](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/revisions/f9a4109cbda6?raw)