Steam Authify

A self-hosted web application for managing Steam Guard two-factor authentication across multiple accounts. Generate TOTP codes, view and accept/decline trade confirmations — all from a single dashboard.

Features

• Steam Guard TOTP — Generate 5-character Steam Guard codes with auto-refresh countdown timer
• Trade Confirmations — View, accept, and decline pending trade/market confirmations (bulk operations supported)
• Multi-Account — Manage multiple Steam accounts from one place
• maFile Import — Upload .maFile exports from Steam Desktop Authenticator
• Programmatic Steam Login — Log in to Steam directly from the app (password-only, 2FA auto-generated)
• Telegram Auth — Sign in via Telegram Login Widget with admin approval workflow
• Encryption at Rest — All secrets (shared_secret, identity_secret, session cookies) encrypted with Fernet
• Audit Logging — All mutations logged with actor, action, and payload
• API Keys — REST API with JWT + API key authentication
• Rate Limiting — Redis-backed rate limiting on sensitive endpoints
• Dark Mode — Light/dark/system theme toggle

Tech Stack

Backend

• Python 3.12 + FastAPI (async)
• PostgreSQL 16 via SQLAlchemy 2.0 (async) + asyncpg
• Redis 7 for caching and rate limiting (slowapi)
• Alembic for database migrations
• Fernet (cryptography) for encryption at rest
• httpx for Steam API communication

Frontend

• React 19 + TypeScript 5.9
• Vite 8 build tool
• Tailwind CSS 4
• shadcn/ui (Base UI) component primitives
• React Router 7
• Axios HTTP client
• sonner toast notifications

Infrastructure

• Docker Compose — PostgreSQL, Redis, FastAPI backend, Nginx + React frontend
• Nginx reverse proxy serving frontend and proxying /api to the backend

Project Structure

.
├── app/                        # Backend (FastAPI)
│   ├── api/
│   │   ├── deps.py             # Auth middleware & Actor model
│   │   └── v1/
│   │       ├── accounts.py     # Account CRUD + code generation
│   │       ├── auth.py         # Telegram login, /auth/me
│   │       ├── confirmations.py# Trade confirmations + Steam sessions
│   │       ├── users.py        # User management (admin)
│   │       └── router.py       # API routing
│   ├── core/
│   │   ├── audit.py            # Audit logging
│   │   ├── jwt.py              # JWT + Telegram verification
│   │   ├── limiter.py          # Rate limiter
│   │   └── security.py         # Fernet encryption, API key hashing
│   ├── models/                 # SQLAlchemy ORM models
│   ├── schemas/                # Pydantic request/response schemas
│   ├── services/
│   │   ├── steam_guard.py      # TOTP code + confirmation key generation
│   │   ├── steam_login.py      # Programmatic Steam login (IAuthenticationService)
│   │   └── steam_confirmations.py  # Fetch/accept/decline confirmations
│   ├── admin/                  # SQLAlchemy Admin panel
│   ├── config.py               # Pydantic settings
│   ├── database.py             # Async session factory
│   └── main.py                 # FastAPI app factory
├── frontend/                   # Frontend (React)
│   ├── src/
│   │   ├── pages/              # Route pages
│   │   ├── components/         # UI components
│   │   └── lib/                # API client, auth/theme contexts
│   └── ...
├── alembic/                    # Database migrations
├── tests/                      # Unit tests
├── docker-compose.yml
├── Dockerfile
└── requirements.txt

Setup

Prerequisites

• Docker and Docker Compose
• A Telegram Bot token (for authentication)

1. Clone and configure

git clone https://github.com/panicua/Steam-Authify.git
cd Steam-Authify
cp .env_example .env

Edit .env and fill in the required values:

# Generate security keys
python -c "import secrets; print(secrets.token_urlsafe(32))"
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

2. Start the application

docker compose up -d --build

This starts:

• PostgreSQL on port 5432 (internal)
• Redis on port 6379 (internal)
• Backend API on port 8000 (internal)
• Frontend + Nginx on port 3000 (exposed)

3. Run database migrations

docker compose exec api alembic upgrade head

4. Access the app

Open http://localhost:3000 and sign in with your Telegram account.

The first user will need to be approved — use the admin panel at http://localhost:3000/admin/ (credentials from .env).

Environment Variables

Variable	Required	Description
POSTGRES_USER	Yes	PostgreSQL username
POSTGRES_PASSWORD	Yes	PostgreSQL password
POSTGRES_DB	Yes	PostgreSQL database name
DATABASE_URL	Yes	Async connection string
REDIS_URL	Yes	Redis connection string
SECRET_KEY	Yes	App secret key
FERNET_KEY	Yes	Encryption key for secrets at rest
ADMIN_USERNAME	Yes	Admin panel username
ADMIN_PASSWORD	Yes	Admin panel password
TELEGRAM_BOT_TOKEN	Yes	Telegram Bot API token
JWT_SECRET_KEY	No	JWT signing key (falls back to SECRET_KEY)
JWT_ACCESS_TOKEN_EXPIRE_MINUTES	No	JWT expiry (default: 10080 = 7 days)
CORS_ORIGINS	No	Comma-separated CORS origins
BOOTSTRAP_TOKEN	No	Protects initial API key creation

Running Tests

# Install test dependencies
pip install -r requirements-dev.txt

# Run tests
pytest tests/ -v

API Overview

Endpoint	Description
POST /api/v1/auth/telegram	Telegram OAuth login
GET /api/v1/accounts	List Steam accounts
POST /api/v1/accounts	Add account (manual)
POST /api/v1/accounts/upload	Add account (.maFile upload)
GET /api/v1/accounts/{id}/code	Generate Steam Guard code
GET /api/v1/accounts/{id}/confirmations	List pending confirmations
POST /api/v1/accounts/{id}/confirmations/{conf_id}/accept	Accept confirmation
POST /api/v1/accounts/{id}/confirmations/{conf_id}/decline	Decline confirmation
POST /api/v1/accounts/{id}/confirmations/batch	Bulk accept/decline
POST /api/v1/accounts/{id}/session/login	Steam login (get session)
GET /api/v1/users	List users (admin)