Steam Sign In

Steam Sign-In

With Steam sign-in, a game client sends a Steamworks ticket and gets a GG Scale session. The server checks the ticket with Valve. You do not run a backend, and the game build contains no secrets. On first sign-in, GG Scale creates a player with the identity steam:<steamid64>.

Configure the provider

In the control panel, open Game Projects and select a Game Project. Then open Game Project settings and go to Steam sign-in. Set two values:

• The App ID is the numeric Steam App ID of your game.
• The Publisher Web API key is a key from a Steamworks publisher group. The group must have access to this App ID. To make the key, follow Valve's publisher Web API key guide. Do not use a personal user key.

GG Scale encrypts the key and does not show it again. To keep the stored key, leave the field empty when you save. To replace it, enter a new value. To remove it, select the disable checkbox. Until both values are set, the endpoint returns 400.

GG Scale encrypts the key with AES-256-GCM. The server makes the encryption key on first boot, so you do not need to configure it. To keep the encryption key out of database backups, set CREDENTIAL_ENC_KEY (64 hex characters). Read Security before you set or change it.

Client flow

1. Get a ticket from the Steamworks SDK. Call GetAuthTicketForWebApi with the identity string ggscale:

   SteamUser()->GetAuthTicketForWebApi("ggscale");
   // handle the GetTicketForWebApiResponse_t callback; hex-encode m_rgubTicket

2. Send the hex-encoded ticket with your Game Project API key:

   curl -s -X POST http://localhost:8080/v1/auth/steam \
     -H "Authorization: Bearer <api_key>" \
     -H "Content-Type: application/json" \
     -d '{"ticket":"14000000048bcd42..."}'

3. The response has the same session fields as the other auth calls:

   {"access_token":"eyJ...","refresh_token":"9f86...","player_id":87,"expires_at":"2026-01-02T15:04:05Z"}

Each sign-in with the same Steam account returns the same player, with all saves, scores, and friends.

Common errors

Status	Meaning	Client action
400	Steam sign-in is not set up for this Game Project.	Set the App ID and key in the control panel.
401	Valve rejected the ticket. The ticket can be expired, for a different app, or for a different identity string.	Get a new ticket and try one time. Do not send the same ticket again.
403 steam account banned	Valve reports a VAC ban or a publisher ban.	Do not retry. Show a clear message.
403 account banned	The Account Tenant banned this player.	Do not retry. Show a clear message.
403 player creation is disabled	The Account Tenant is at its player limit. This occurs only on the first sign-in of a new Steam account.	Do not retry. The developer must raise the limit. See Quotas, Tiers, and Entitlements.
502	GG Scale could not reach Valve, or Valve sent an error.	Retry with backoff, or offer a different sign-in method.

Notes

• With Family Sharing, the identity is the account that plays (steamid), not the owner (ownersteamid). A player who borrows the game gets a separate player and separate saves.
• Bans that you set inside your game are separate from Valve bans.
• GG Scale sends the identity string ggscale to Valve with each check. Use GetAuthTicketForWebApi("ggscale"), not the older GetAuthSessionTicket call.
• A ticket is for one sign-in, and it expires quickly. Get a new ticket for each sign-in. Do not store tickets.

To add Steam to an anonymous player, see Account Linking.

Full reference: the /v1/auth/steam operation.