---
title: "📦 Automate Steam Login Process"
method: POST
path: "/steam/api/steamloginsecure"
tags: ["Account"]
---

# 📦 Automate Steam Login Process

`POST /steam/api/steamloginsecure`

## Request

- Base URL: `https://www.steamwebapi.com`
- URL: `https://www.steamwebapi.com/steam/api/steamloginsecure`
- Auth: API key in query parameter `key`

Baseurl: https://www.steamwebapi.com/steam/api/steamloginsecure

        💬 **What this endpoint does:**
        - Automates your Steam login process, including for trading, market, and other Steam Community features.
        - With the `steamLoginSecure` cookie, you can use our Trading API and build easy-to-use trading bots, market trackers, and more.

        🛠️ **How to use:**
        There are **two ways to authenticate**:

        1. **Username + Password Login**
           - Send a POST request with your Steam `username` and `password` in the request body.
           - If your account is protected by Steam Guard, include the `code` parameter from your mobile authenticator.

        2. **Refresh Token Login**
           - Instead of username/password, you can provide a `steamrefreshtoken` (JWT).
           - This token is returned after the initial login and allows you to request a fresh `steamLoginSecure` cookie without needing to re-enter credentials.

        🚨 **Important Note:**
        - Do **not** provide both login credentials and `steamrefreshtoken` at the same time.
        - One of the two options must be present, not both.

        🌐 **Additional Info:**
        - The login process is handled securely. No password is stored server-side.
        - This endpoint is ideal for building:
          - Trading bots
          - Market analyzers
          - Automated session checkers

        📦 **Response:**
        - On success, you will receive the following cookies:
          - `steamLoginSecure` – required for authenticated Steam Community actions
          - `sessionid` – required for most web interactions
          - `browserid` – identifies the browser/session
          - `steamrefreshtoken` – reusable token to fetch new `steamLoginSecure` cookies later

        🕒 **Token Lifespan**
        - The `steamrefreshtoken` is typically valid for **up to 6 months**
        - It can be used repeatedly to retrieve new `steamLoginSecure` cookies without logging in again.

## Request body

- object
  - `username` string: Your Steam username (optional if steamrefreshtoken is provided)
  - `password` string: Your Steam account password (optional if steamrefreshtoken is provided)
  - `code` string: - optional - Steam Guard code (optional, only if Steam Guard is enabled)
  - `steamrefreshtoken` string: optional, this you will get after first login - This is the second auth method - A long-lived refresh token (JWT) that can be used to request a new steamLoginSecure at any time.

## Response `200`

Successfully logged in to Steam. Cookies are returned.

- object
  - `success` boolean
  - `message` string
  - `cookies` object
    - `steamloginsecure` string
    - `steamloginsecureexp` string, date-time
    - `steamrefreshtoken` string
    - `steamrefreshtokenexp` string, date-time
    - `sessionid` string
    - `browserid` string
    - `steamid` string

## Other responses

- `411`: Invalid username or password provided.
- `412`: Failed to retrieve valid cookies from Steam.
- `413`: SteamLoginSecure is invalid.
- `421`: Invalid request body or missing required parameters.
- `429`: Rate limit exceeded. Try again later.

---

[API](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation.md) · [All operations](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/llms.txt) · [OpenAPI document](https://skmtc.dev/steamwebapi/apis/steamwebapi-com-third-party-steam-market-api-documentation/revisions/f9a4109cbda6?raw)