Will we get the player's email?

No. Steam login returns only the SteamID. If an email is needed, e.g. for invoices, we ask for it separately.

Can Steam be combined with Discord login?

Yes. One site account can link a SteamID and a Discord account, e.g. so a game rank grants a Discord server role.

Is a Steam Web API key paid?

You create the key on a Steam account. The API terms of use apply, including the 100,000 calls a day limit.

How much does an integration cost?

Integrations are quoted individually, under our API and integrations service. The figure depends on how many systems we connect, which data flows where and what should happen on an error. We give it after a short call, and the quote is free and comes back within an hour.

Will the integration code be mine?

Yes. Once the work is accepted and paid in full, the economic copyright in the code passes to you and you get the repository with run instructions. Open source libraries keep their own licences.

How do you check an integration before launch?

On the provider's test environment or on a copy of your system. We run real scenarios, including errors, cancellations and returns, and only then switch the integration on in production.

What if the integration stops working?

The integration logs every operation and retries the ones that failed by itself. When the problem does not go away you get a notification, and bugs that come from our work are fixed under warranty.

What if the provider changes its API?

We follow the provider's change notices and tell you in advance what needs adjusting. We make that adjustment under a maintenance plan or as a separate short order.

Steam integration: Steam login and the Steam Web API

A player signs in to your server website with Steam, no new password. Their SteamID ties the site account to the game account, and the Steam Web API supplies the name, avatar, playtime and ban data. The panel, item shop and rewards run on that.

Game servers

The server store on a phone: Steam sign-in before buying a VIP rank, with what the site will and will not get

Steam as a login provider

Steam supports OpenID 2.0. After sign-in the site gets the player's 64-bit SteamID and nothing else.

Steam hands over an identifier only

SteamID

The 64-bit account number at the end of the identifier that comes back from Steam after sign-in.

formathttp://steamcommunity.com/openid/id/<steamid>

Steamworks: authentication and OpenID

The profile is a separate request

…should only be used if your website needs to display information about a user.

Steamworks: ISteamUser/GetPlayerSummaries

The player knows what the site will not get

The sign-in sheet of the server store: the Sign in with Steam button and what the site will and will not get

Before sign-in the store says it plainly: the SteamID, name and avatar, playtime if the profile shows it. No password and no email.

Steam login step by step

The verification step matters most. The parameters in the return URL come from the player's browser, so they cannot be trusted until Steam confirms them.

Player
clicks "Sign in with Steam"
A return to our address
The response must return to our address, not a substituted one.
Confirmation at the source
Direct verification from OpenID 2.0: we send the same parameters back to Steam with check_authentication mode. A SteamID from the URL without Steam's confirmation can be forged with one URL edit.
The account only after confirmation
Only after confirmation do we read the SteamID and link it to the account. The name, avatar and bans then come from the Steam Web API, and its key stays on the server.
Account on the site
SteamID, name, avatar and bans

What the SteamID ties together on the site and in game

One player account everywhere.

76561190000001184 · Player 03 · 312 h · VAC: none · VIP

76561190000001184 · Player 03 · 312 h · VAC: none Steam → site, panel, game server

VIP both ways

76561190000001184

Player identity

Steam login.

Player 03

Name and avatar

Login and a periodic refresh.

312 h

Playtime

A periodic job, if the profile shows it.

VAC: none

Bans

Login or joining the server.

VIP

Item shop purchases

A payment on the site: the item or rank reaches the server by SteamID.

The SteamID as the key

On game servers the SteamID is usually already the key in the database: in permissions, stats and bans. So linking the site to the game by SteamID is natural and needs no codes typed by the player.

Private profiles

Playtime is available only when the data is visible. Playtime rewards show a clear message when the profile hides it.

The Steam Web API methods we use

Player data after sign-in. Some of it depends on profile privacy settings.

Steam Web API calls a day

The limit in the key's terms of use.

0100 000

within the limitover the limit

GetPlayerSummaries SteamIDs per request

Name, avatar, profile URL, visibility, up to 100 players at once.

0100

one callthe next call

The methods we use

ISteamUser/GetPlayerSummaries v2Name, avatar, profile URL, visibility, up to 100 players at once. The profile in the panel and leaderboard.
IPlayerService/GetOwnedGamesGames and playtime, if visible. Rewards for playtime.
ISteamUser/GetPlayerBansVAC and game bans, days since the last ban. Server access decisions.
IPlayerService/GetSteamLevelThe Steam account level. A threshold for new accounts, e.g. in giveaways.
ISteamUser/CheckAppOwnershipWhether the player owns a given game. Only for the game's publisher, with a publisher key.

What moves the use of the limit

Profile cache

With 100,000 calls a day, asking Steam on every page view quickly uses up the limit.

fewer calls

Batched requests

GetPlayerSummaries takes up to 100 SteamIDs at once, so we refresh leaderboards in batches.

100 players in one call

A request on every page view

Without a cache every view of a profile or leaderboard is a separate Steam call.

the limit runs out fast

Common questions about Steam integration

Answers about the player's email, Discord sign-in, the Web API key and the quote.

VulCode Support

Online

Click a question on the left to start a conversation

Want Steam login on your server website?

Tell us which game you run and what should happen after sign-in. We will reply within an hour with questions and a quote.