steam-user

Most legacy chat-related events in SteamUser are deprecated. Instead of listening to events like friendMessage, chatMessage, or chatUserJoined directly on the SteamUser instance, you should use the SteamChatRoomClient available via the chat property of your SteamUser instance.

Deprecated events include:

• friendOrChatMessage
• friendMessage
• friendTyping
• friendLeftConversation
• friendMessageEcho
• friendTypingEcho
• chatMessage (and ID variants like chatMessage#roomID)
• chatHistory
• chatInvite (and ID variants like chatInvite#inviterID#chatID)
• chatCreated
• chatEnter
• chatLeft
• chatUserJoined
• chatUserLeft
• chatUserDisconnected
• chatUserKicked
• chatUserBanned
• chatUserSpeaking
• chatUserDoneSpeaking
• chatSetPublic

The legacy chat room events (such as chatSetPrivate, chatSetOfficersOnly, and others related to chat room locking/unlocking) are deprecated.

Instead of listening to these events directly on the SteamUser instance, you should use the SteamChatRoomClient which is accessible via the chat property of your SteamUser instance. For detailed usage, refer to the SteamChatRoomClient documentation.

Most SteamUser methods support both callbacks and Promises.

• Promises: All methods that return data return a Promise that resolves to a single object containing the method's data properties.
• Callbacks: Legacy callbacks return data across multiple arguments. Newer callbacks return a single response object that is identical to the Promise output.

Important Note on Error Handling:

• You are never required to use callbacks over Promises.
• If a callback is listed as optional, an unhandled promise rejection will not raise a warning/error.
• If a callback is listed as required and you provide neither a callback nor handle the promise rejection, a promise rejection will raise a warning and may eventually cause a crash.

To determine if an account is eligible for trading, you must verify several Steam Guard conditions. An account is considered to meet trading requirements if:

1. isSteamGuardEnabled is true.
2. timestampSteamGuardEnabled is at least 15 days in the past.
3. Either timestampMachineSteamGuardEnabled OR timestampTwoFactorEnabled is at least 7 days in the past.

Use the account details request to retrieve these timestamps.

Steam enums are available directly on the SteamUser module. For example, you can access EResult via SteamUser.EResult.

For convenience, you can perform reverse lookups. If you have an enum value (e.g., 88), you can retrieve its string name (e.g., TwoFactorCodeMismatch) by accessing the enum as an object: SteamUser.EResult[88].

// Example of reverse lookup
const resultName = SteamUser.EResult[88]; // 'TwoFactorCodeMismatch'

Refresh tokens are the recommended way to maintain long-term sessions. They are JWTs valid for approximately 200 days.

When you log on using an accountName and password, steam-user will internally fetch a refresh token, emit the refreshToken event, and then use that token for subsequent logins. You can decode the JWT to check the exp property to see when the token expires.

When using email Steam Guard, machine auth tokens allow a device to be remembered, bypassing the need for a code every time you log in.

By default, steam-user automatically saves these tokens in your dataDirectory. You can also manage them manually by listening for the machineAuthToken event and providing the token via the machineAuthToken property in logOn().

Install the steam-user module using npm. Requires Node.js v14.0.0 or later.

$ npm install steam-user

The steamGuard event is emitted when Steam requests an authentication code (via email or app).

Important for 2FA users: If you are using Two-Factor Authentication (TOTP), you must check the lastCodeWrong argument. If lastCodeWrong is true, the previous code provided was incorrect or already used. You must wait 30 seconds before providing a new code to allow the TOTP algorithm to generate a new one. Failing to wait can result in a login loop and a temporary IP ban.

If no listener is bound to this event, steam-user will attempt to prompt the user for a code via stdin.

user.on('steamGuard', function(domain, callback) {
	console.log("Steam Guard code needed from email ending in " + domain);
	var code = getCodeSomehow();
	callback(code);
});