Is there any API a steam game can use to check if a user bought the game (instead of having it pirated)?

What I want to do is just the following:

  • Call Steam API from Game to get some kind of token.
  • Then pass that unique token to my server.
  • My server do a request to Steam API to check if user has bought with real money the game: if the user bought the game, then I'll allow him to access my game server (which enable multiplayer etc.)

In Addition, Is there anyway to force the Steam Token to change everytime I request it? (In that way, if someone steal the token once it would not be able to use it forever, or maybe steam offers already something more secure than that?).

  • 1
    \$\begingroup\$ steampowered.com/steamworks/publishingservices.php \$\endgroup\$ Feb 10, 2017 at 11:36
  • \$\begingroup\$ The first 3 points are used by Steam to generate a Token if the game is runned from the correct machine. The only usefull point is key-based authentication, though I don't find any reference to a method I can call from my server to check if the token provided by the user is valid (like facebook does). \$\endgroup\$ Feb 10, 2017 at 13:03
  • \$\begingroup\$ In example, in PlayStore, for each in-App purchase I receive 1 code, that I can check with my server (my sserver receive the code from App and connect to Google's servers to check if the code is valid) to not be a fake code. How do I achieve the same in Steam? \$\endgroup\$ Feb 10, 2017 at 13:05
  • 1
    \$\begingroup\$ There's not something similiar to Steam API anyway. I know from theorical point of view how that stuff works, just asking if Steam have the functions for that or if they don't bothered implementing that feature. (Infact I already do It for Google Play Services Login and In-App purchases). Unluckily seems that there are not so many questions about steam \$\endgroup\$ Feb 14, 2017 at 12:48
  • 1
    \$\begingroup\$ Can't you have the user OAuth in your game to confirm their steam identity and then check their profile to see if they have the game? Or if it's launched from steam you should be able to get their profile that way and check too. That relies on users not being able to get pirated games in their Steam library which I can't see any avenue to do that. \$\endgroup\$
    – Cobertos
    Feb 16, 2017 at 14:29

2 Answers 2


If you trust Steam to be secure enough that users can't add games to their account without actually purchasing them (which, let's be honest, if they could, Steam probably has waaay bigger problems than just that), then you could just query their Steam account.

Method 1: OpenID

Upsides: No Steam binaries to bundle. Potentially no need to take the users password yourself (unless they can't be sent to Steams website through a web browser and you need to collect it yourself).

Downsides: Doesn't work for private profiles. Requires a web browser.

For just OpenID logins you can have the user do their login (either on Steams website or through your code) to assert their identity and then run queries to the Steam Web API based on that identity.

According to steamcommunity.com/dev,

Steam can act as an OpenID provider. This allows your application to authenticate a user's SteamID without requiring them to enter their Steam username or password on your site (which would be a violation of the API Terms of Use.) Just download an OpenID library for your language and platform of choice and use http://steamcommunity.com/openid as the provider. The returned Claimed ID will contain the user's 64-bit SteamID. ...

Using that SteamID you can query Steam with any of the API endpoints but you'd specifically want to call GetOwnedGames and then make sure that it includes your game (note that this wouldn't work for private profiles though). It seems like there's already a bunch of implementations in various languages to query their API though.

Method 2: Steamworks API

Upsides: Seamless integration

Downsides: Requires bundling with another library

If you bundle your game with the Steamworks API then you can use that API to do the calls mentioned in Method 1. They specifically say,

Steamworks provides a variety of methods for authenticating a Steam user between game clients, game servers, and websites.

...and provide a documentation link (but it appears to be broken.

It seems like there's quite a few libraries that wrap the Steamworks API available on GitHub and are probably more.


You can use the methods outlined on Steamworks User Authentication and Ownership:

Between a game client and other clients (P2P) or game servers using Session Tickets

Those pages should have all the information you need, but I'll summarize a bit.


I think the most generic method is to use the Steamworks Web API: In the game you call ISteamUser.GetAuthTicketForWebApi and send that ticket to the server and on the server you use the ISteamUserAuth/AuthenticateUserTicket webapi endpoint. No steam-specific libraries required.

As the docs note mentions, the webapi call requires a publisher API key, which you create with your admin Steamworks account. Never include your API key with an executable downloaded by users or they can wreak havoc!

Now you know the user is who they say they are and can use ISteamUser/CheckAppOwnership to verify they own the game.


However, for a multiplayer game server, you may be better served by the ISteamGameServer API where you can begin and end an auth session and also have access to other game server features.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .