IAuthenticationService – Steam Web API Documentation

This page is just a reference of all the known Steam APIs, I do not know how they work. Please do not email me with questions.

POSTBeginAuthSessionViaCredentials

start authentication process

https://api.steampowered.com/IAuthenticationService/BeginAuthSessionViaCredentials/v1/

Name	Type	Required	Description
device_friendly_name	string	Yes
account_name	string	Yes
encrypted_password	string	Yes	password, RSA encrypted client side
encryption_timestamp	uint64	Yes	timestamp to map to a key - STime
remember_login	bool	Yes	deprecated
platform_type	{enum}	Yes
persistence	{enum}	No	whether we are requesting a persistent or an ephemeral session
website_id	string	No	(EMachineAuthWebDomain) identifier of client requesting auth
device_details	{message}	Yes	User-supplied details about the device attempting to sign in
guard_data	string	Yes	steam guard data for client login
language	uint32	Yes
qos_level	int32	No	[ENetQOSLevel] client-specified priority for this auth attempt

POSTBeginAuthSessionViaQR

start authentication process

https://api.steampowered.com/IAuthenticationService/BeginAuthSessionViaQR/v1/

Name	Type	Required	Description
device_friendly_name	string	Yes
platform_type	{enum}	Yes
device_details	{message}	Yes	User-supplied details about the device attempting to sign in
website_id	string	No	(EMachineAuthWebDomain) identifier of client requesting auth

UNDOCUMENTEDPOSTEnumerateTokens

Enumerate durable (refresh) tokens for the given subject account

https://api.steampowered.com/IAuthenticationService/EnumerateTokens/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key
include_revoked		bool	No

UNDOCUMENTEDPOSTGenerateAccessTokenForApp

Given a refresh token for a client app audience (e.g. desktop client / mobile client), generate an access token

https://api.steampowered.com/IAuthenticationService/GenerateAccessTokenForApp/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key
refresh_token		string	No
steamid		fixed64	No
renewal_type		ETokenRenewalType	No	enum

POSTGetAuthSessionInfo

get metadata of specific auth session, this will also implicitly bind the calling account

https://api.steampowered.com/IAuthenticationService/GetAuthSessionInfo/v1/

Name	Value	Type	Required	Description
client_id		uint64	Yes	client ID from scanned QR Code, used for routing

POSTGetAuthSessionRiskInfo

get risk metadata for a specific auth session that has been deemed risky

https://api.steampowered.com/IAuthenticationService/GetAuthSessionRiskInfo/v1/

Name	Value	Type	Required	Description
client_id		uint64	Yes	client ID from scanned QR Code, used for routing
language		uint32	Yes	language for optimistic localization of geoloc data

UNDOCUMENTEDGetAuthSessionsForAccount

Gets all active auth sessions for an account for reference by the mobile app

https://api.steampowered.com/IAuthenticationService/GetAuthSessionsForAccount/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key

GETGetPasswordRSAPublicKey

Fetches RSA public key to use to encrypt passwords for a given account name

https://api.steampowered.com/IAuthenticationService/GetPasswordRSAPublicKey/v1/

Name	Value	Type	Required	Description
account_name		string	Yes	user-provided account name to get an RSA key for

UNDOCUMENTEDPOSTMigrateMobileSession

Migrates a WG token to an access and refresh token using a signature generated with the user's 2FA secret

https://api.steampowered.com/IAuthenticationService/MigrateMobileSession/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key
steamid		fixed64	No	Steam ID of the user to migrate
token		string	No	WG Token to migrate
signature		string	No	Signature over the wg token using the user's 2FA token

POSTNotifyRiskQuizResults

notify the server about risk quiz responses for metrics purposes

https://api.steampowered.com/IAuthenticationService/NotifyRiskQuizResults/v1/

Name	Type	Required	Description
client_id	uint64	Yes	client ID for the auth session, used for routing
results	{message}	Yes	Whether or not the user correctly answered each risk quiz question
selected_action	string	Yes	The action being taken selected by the user during the quiz
did_confirm_login	bool	Yes	Whether or not the user went on to confirm the login or not in the case of a passed quiz

POSTPollAuthSessionStatus

poll during authentication process

https://api.steampowered.com/IAuthenticationService/PollAuthSessionStatus/v1/

Name	Type	Required	Description
client_id	uint64	Yes
request_id	string	Yes
token_to_revoke	uint64	Yes	If this is set to a token owned by this user, that token will be retired

UNDOCUMENTEDPOSTRevokeRefreshToken

Mark the given refresh token as revoked

https://api.steampowered.com/IAuthenticationService/RevokeRefreshToken/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key
token_id		fixed64	No
steamid		fixed64	No	Token holder if an admin action on behalf of another user
revoke_action		EAuthTokenRevokeAction	No	Select between logout and logout-and-forget-machine
signature		bytes	No	required signature over token_id

UNDOCUMENTEDPOSTRevokeToken

Revoke a single token immediately, making it unable to renew or generate new access tokens

https://api.steampowered.com/IAuthenticationService/RevokeToken/v1/

Name	Value	Type	Required	Description
key	click to set	string	Yes	Access key
token		string	No
revoke_action		EAuthTokenRevokeAction	No	Select between logout and logout-and-forget-machine

POSTUpdateAuthSessionWithMobileConfirmation

approve an authentication session via mobile 2fa

https://api.steampowered.com/IAuthenticationService/UpdateAuthSessionWithMobileConfirmation/v1/

Name	Type	Required	Description
version	int32	Yes	version field
client_id	uint64	Yes	pending client ID, from scanned QR Code
steamid	uint64	Yes	user who wants to login
signature	string	Yes	HMAC digest over {version,client_id,steamid} via user's private key
confirm	bool	No	Whether to confirm the login (true) or deny the login (false)
persistence	{enum}	No	whether we are requesting a persistent or an ephemeral session

POSTUpdateAuthSessionWithSteamGuardCode

approve an authentication session via steam guard code

https://api.steampowered.com/IAuthenticationService/UpdateAuthSessionWithSteamGuardCode/v1/

Name	Type	Required	Description
client_id	uint64	Yes	pending client ID, from initialized session
steamid	uint64	Yes	user who wants to login
code	string	Yes	confirmation code
code_type	{enum}	Yes	type of confirmation code