WebAuth

WebAuth

steam.webauth.WebAuth produces an authenticated requests.Session that carries the cookies Steam's web properties expect — store.steampowered.com, steamcommunity.com, help.steampowered.com.

It's the right tool when you need to scrape / drive the storefront or the community pages as a logged-in user, but don't want the whole CM/gevent stack. If you already have a live SteamClient, use client.get_web_session() instead — it bootstraps the same cookies from your CM login.

WebAuth (desktop)

import steam.webauth as wa

user = wa.WebAuth('username')

# Interactive login prompt loop — handles password + 2FA + captcha.
session = user.cli_login('password')

# session is a plain requests.Session — everything works normally.
session.get('https://store.steampowered.com/account/history')

cli_login() retries password, captcha, email code, and 2FA prompts until Steam accepts.

For programmatic use, call .login() directly and catch the specific exceptions Steam raises:

try:
    user.login('password')
except wa.LoginIncorrect:
    ...   # ask for new password
except wa.CaptchaRequired:
    print(user.captcha_url)   # solve manually
    user.login(captcha='ABCDE')
except wa.EmailCodeRequired:
    user.login(email_code='ZXC123')
except wa.TwoFactorCodeRequired:
    user.login(twofactor_code='ZXC123')

Signatures

WebAuth(username, password='')

.login(password='', captcha='', email_code='', twofactor_code='', language='english') -> requests.Session
.cli_login(password='', captcha='', email_code='', twofactor_code='', language='english') -> requests.Session

Instance attributes

• .session — the requests.Session. Populated on construction, has cookies set after successful login.
• .session_id — Steam session id string, populated after login.
• .steam_id — SteamID for the logged-in account, populated after login.
• .logged_on — True once auth succeeded.
• .captcha_url — full URL to the captcha image when CaptchaRequired is raised, else None.

Exceptions

All inherit from WebAuthException:

• LoginIncorrect — wrong username or password.
• CaptchaRequired — Steam wants a captcha solution. Read user.captcha_url, solve, pass into .login(captcha=...).
• CaptchaRequiredLoginIncorrect — subclass of both, raised when Steam wants a captcha and the previous password was wrong.
• EmailCodeRequired — Steam Guard email code needed.
• TwoFactorCodeRequired — Steam Guard 2FA code needed.
• TooManyLoginFailures — Steam rate-limited the account.
• HTTPError — transport error (5xx, connection failure, DNS, etc).

After login

The requests.Session is ready to use — cookies are set across store.steampowered.com, help.steampowered.com, and steamcommunity.com, plus Steam_Language, birthtime, and sessionid on each.

Web sessions can expire randomly, or when your IP changes. Some pages return HTTP 401 when that happens. Catch it and re-login if you're writing robust code.

MobileWebAuth

Same login flow, but authenticates as a mobile device — needed for trade confirmations and other flows that require an OAuth token.

import steam.webauth as wa

user = wa.MobileWebAuth('username')
session = user.cli_login('password')

print(user.oauth_token)   # populated after login

Everything works exactly like WebAuth — same exceptions, same cli_login() / .login() signatures. The differences:

• Sends mobileClientVersion=0 (2.1.3) + mobileClient=android cookies during the login POST.
• Populates .oauth_token from the login response.
• Sets steamLogin / steamLoginSecure cookies with the OAuth-issued session token.

oauth_login

If you already have a mobile OAuth token and SteamID from a previous session, skip the password / 2FA dance:

user = wa.MobileWebAuth('username')
session = user.oauth_login(oauth_token='<token>', steam_id='76561197960265740')

Signature: oauth_login(oauth_token='', steam_id='', language='english') -> requests.Session

Raises LoginIncorrect('invalid token') if the token is stale.

Session sharing

The requests.Session from WebAuth composes cleanly with other requests-based components in this library:

from steam.webapi import WebAPI

api = WebAPI(key='...')
api.session = user.session   # share cookies between webapi and webauth

Which means once you've hit store.steampowered.com, subsequent api.ISteamUser.* calls carry the same identity.

Where to go next

• Need to actually manage Steam Guard 2FA? SteamAuthenticator — takes a MobileWebAuth as its backend.
• Want the same session cookies from an already-logged-in CM connection instead? Use client.get_web_session() on your SteamClient — the Web mixin at steam/client/builtins/web.py.
• Doing storefront scraping? Just use the returned session against the plain store.steampowered.com URLs. All the requests.Session methods work.