-1
\$\begingroup\$

Is there any API a steam game can use to check if a user bought the game (instead of having it pirated)?

What I want to do is just the following:

  • Call Steam API from Game to get some kind of token.
  • Then pass that unique token to my server.
  • My server do a request to Steam API to check if user has bought with real money the game: if the user bought the game, then I'll allow him to access my game server (which enable multiplayer etc.)

In Addition, Is there anyway to force the Steam Token to change everytime I request it? (In that way, if someone steal the token once it would not be able to use it forever, or maybe steam offers already something more secure than that?).

\$\endgroup\$
  • 1
    \$\begingroup\$ steampowered.com/steamworks/publishingservices.php \$\endgroup\$ – ratchet freak Feb 10 '17 at 11:36
  • \$\begingroup\$ The first 3 points are used by Steam to generate a Token if the game is runned from the correct machine. The only usefull point is key-based authentication, though I don't find any reference to a method I can call from my server to check if the token provided by the user is valid (like facebook does). \$\endgroup\$ – CoffeDeveloper Feb 10 '17 at 13:03
  • \$\begingroup\$ In example, in PlayStore, for each in-App purchase I receive 1 code, that I can check with my server (my sserver receive the code from App and connect to Google's servers to check if the code is valid) to not be a fake code. How do I achieve the same in Steam? \$\endgroup\$ – CoffeDeveloper Feb 10 '17 at 13:05
  • 1
    \$\begingroup\$ There's not something similiar to Steam API anyway. I know from theorical point of view how that stuff works, just asking if Steam have the functions for that or if they don't bothered implementing that feature. (Infact I already do It for Google Play Services Login and In-App purchases). Unluckily seems that there are not so many questions about steam \$\endgroup\$ – CoffeDeveloper Feb 14 '17 at 12:48
  • 1
    \$\begingroup\$ Can't you have the user OAuth in your game to confirm their steam identity and then check their profile to see if they have the game? Or if it's launched from steam you should be able to get their profile that way and check too. That relies on users not being able to get pirated games in their Steam library which I can't see any avenue to do that. \$\endgroup\$ – Coburn Feb 16 '17 at 14:29
1
+50
\$\begingroup\$

If you trust Steam to be secure enough that users can't add games to their account without actually purchasing them (which, let's be honest, if they could, Steam probably has waaay bigger problems than just that), then you could just query their Steam account.

Method 1: OpenID

Upsides: No Steam binaries to bundle. Potentially no need to take the users password yourself (unless they can't be sent to Steams website through a web browser and you need to collect it yourself).

Downsides: Doesn't work for private profiles. Requires a web browser.

For just OpenID logins you can have the user do their login (either on Steams website or through your code) to assert their identity and then run queries to the Steam Web API based on that identity.

According to steamcommunity.com/dev,

Steam can act as an OpenID provider. This allows your application to authenticate a user's SteamID without requiring them to enter their Steam username or password on your site (which would be a violation of the API Terms of Use.) Just download an OpenID library for your language and platform of choice and use http://steamcommunity.com/openid as the provider. The returned Claimed ID will contain the user's 64-bit SteamID. ...

Using that SteamID you can query Steam with any of the API endpoints but you'd specifically want to call GetOwnedGames and then make sure that it includes your game (note that this wouldn't work for private profiles though). It seems like there's already a bunch of implementations in various languages to query their API though.

Method 2: Steamworks API

Upsides: Seamless integration

Downsides: Requires bundling with another library

If you bundle your game with the Steamworks API then you can use that API to do the calls mentioned in Method 1. They specifically say,

Steamworks provides a variety of methods for authenticating a Steam user between game clients, game servers, and websites.

...and provide a documentation link (but it appears to be broken.

It seems like there's quite a few libraries that wrap the Steamworks API available on GitHub and are probably more.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.