Skip to content

Two factor authentication uk UA

Jump to bottom
ArchiBot edited this page Jul 7, 2025 · 32 revisions

Двофакторна аутентифікація

Steam використовує двофакторну систему автентифікації, яка вимагає додаткових даних для різних дій, пов'язаних з акаунтом. Ви можете прочитати більше про це тут і тут. На цій сторінці розглядається система 2FA, а також наше рішення, яке інтегрується з нею, під назвою ASF 2FA.

ASF логіка

Незалежно від того, чи використовуєте ви ASF 2FA чи ні, ASF включає належну логіку і повністю знає акаунти, захищені 2FA в Steam. Він запитає вас про необхідні дані, коли вони потрібні (наприклад, під час входу в систему). Хоча ви можете надати цю інформацію вручну, деякі функції ASF (наприклад, MatchActively) вимагають, щоб у вашому обліковому записі бота була активна функція ASF 2FA, яка може автоматично відповідати на запити 2FA, коли цього вимагає ASF.

ASF 2FA

ASF 2FA - це вбудований модуль, який відповідає за надання функцій 2FA в процесі ASF, таких як генерація токенів і прийняття підтверджень. Він може працювати як в автономному режимі, так і шляхом дублювання даних вашого існуючого автентифікатора (щоб ви могли використовувати ваш поточний автентифікатор і ASF 2FA одночасно).

Ви можете перевірити, чи використовує ваш обліковий запис бота ASF 2FA, виконавши 2fa команди. Без налаштування ASF 2FA всі стандартні команди 2fa не працюватимуть, а це означає, що ваш бот буде недоступний для розширених функцій ASF, які вимагають роботи модуля.

Рекомендації

Існує багато способів залучити ASF 2FA, тут ми наводимо наші рекомендації, засновані на вашій поточній ситуації:

  • Якщо ви вже використовуєте неофіційний сторонній додаток, який дозволяє легко витягувати дані 2FA, просто імпортуйте їх до ASF.
  • Якщо ви використовуєте офіційний додаток і не проти скинути свої облікові дані 2FA, найкращий спосіб - вимкнути 2FA, а потім створити нові облікові дані 2FA за допомогою спільного автентифікатора, що дозволить вам використовувати офіційний додаток і ASF 2FA. Цей метод не вимагає глибоких або просунутих знань, достатньо лише слідувати інструкціям, написаним тут, і, можливо, є кращим для цього сценарію.
  • Якщо ви використовуєте офіційний додаток і не хочете відтворювати свої облікові дані 2FA, ваші можливості дуже обмежені, зазвичай вам знадобляться права root і додаткові зусилля, щоб імпортувати ці дані, і навіть з ними це може виявитися неможливим.
  • Якщо ви ще не використовуєте 2FA і вас це не хвилює, ми рекомендуємо вам використовувати ASF 2FA з окремим автентифікатором або спільним автентифікатором з офіційним додатком (як описано вище).

Нижче ми розглянемо всі можливі варіанти та відомі нам методи.

Створення

ASF постачається з офіційним MobileAuthenticator плагіном, який ще більше розширює ASF 2FA, дозволяючи вам під'єднати абсолютно новий 2FA автентифікатор. Це може бути корисно, якщо ви не можете або не хочете використовувати інші інструменти й не заперечуєте проти того, щоб ASF 2FA став вашим основним (та, можливо, єдиним) автентифікатором. Процес створення також використовується в методі автентифікації з'єднань, природно в цьому сценарії ваш автентифікатор може співіснувати у двох місцях лише раз. Обидва коди згенерують однакові коди, і обидва зможуть підтвердити одне і те саме підтвердження.

Common steps for both scenarios

No matter if you plan to use ASF as the standalone or joint authenticator, you need to do those initialization steps:

  1. Create an ASF bot for the target account, start it, and log in, which you probably already did.
  2. Assign a working and operational phone number to the account here to be used by the bot. This will allow you to receive SMS code and allow recovery if needed. This step is not mandatory in all scenarios, however, we recommend it unless you know what you're doing.
  3. Ensure you're not using 2FA yet for your account, if you do, disable it first. This will put your account on temporary trade-hold, there is no way around it, only import process can skip it.
  4. Execute the 2fainit [Bot] command, replacing [Bot] with your bot's name.

Assuming you got a successful reply, the following two things have happened:

  • A new <Bot>.maFile.PENDING file was generated by ASF in your config directory.
  • SMS was sent from Steam to the phone number you have assigned for the account above. If you didn't set a phone number, then an email was sent instead to the account e-mail address.

The authenticator details are not operational yet, however, you can review the generated file if you'd like to. If you want to be double safe, you can, for example, already write down the revocation code. The next steps will depend on your selected scenario.

Standalone authenticator

If you want to use ASF as your main (or even only) authenticator, now you need to do the final finalization step:

  1. Execute the 2fafinalize [Bot] <ActivationCode> command, replacing [Bot] with your bot's name and <ActivationCode> with the code you've received through SMS or e-mail in the previous step.

Joint authenticator

If you want to have the same authenticator in both ASF and the official Steam mobile app, now you need to do the next, more tricky steps:

  1. Ignore the SMS or e-mail code that you've received in the previous step.
  2. Install the Steam mobile app if it's not installed yet, and open it. Navigate to the Steam Guard tab and add a new authenticator by following the app's instructions.
  3. After your authenticator in the mobile app is added and working, return to ASF. Now, instead of finalization, we only need to inform ASF that mobile app already activated our previously-generated details:
  • Wait until the next 2FA code is shown in the Steam mobile app, and use the command 2fafinalized [Bot] <2FACodeFromApp> replacing [Bot] with your bot's name and <2FACodeFromApp> with the code you currently see in the Steam mobile app. If the code generated by ASF and the code you provided are equal, ASF will assume that an authenticator was added correctly and proceed with importing your newly created authenticator.
  • We strongly recommend to do the above in order to ensure that your credentials are valid. However, if you don't want to (or can't) check if codes are the same and you know what you're doing, you can instead use the command 2fafinalizedforce [Bot], replacing [Bot] with your bot's name. ASF will assume that the authenticator was added correctly and proceed with importing your newly created authenticator. Be aware that in this mode ASF is unable to verify if the codes match, which means that you can potentially import invalid (not activated) credentials.

After finalization

Assuming everything worked properly, the previously generated <Bot>.maFile.PENDING file was renamed to <Bot>.maFile.NEW. This indicates that your 2FA credentials are now valid and active. We recommend that you move that file outside of config directory to a secure and safe location. In addition to that, if you've decided to use standalone authenticator, then we recommend you to open the file in your editor of choice and write down the revocation_code, which will allow you to, as the name implies, revoke the authenticator in case you lose it. In joint-authenticator method, you should've already done that in Steam mobile app, but feel free to do the same in case you need to.

In regards to technical details, the generated maFile includes all details that we've received from the Steam server during linking the authenticator, and in addition to that, the device_id field, which may be needed for other (third-party) authenticators, if you ever decide to import that maFile into them.

ASF automatically imports your authenticator once the procedure is done, and therefore 2fa and other related commands should now be operational for the bot account you linked the authenticator to. We recommend you to verify that.

Імпорт

Import process requires already linked and operational authenticator that is supported by ASF. We have instructions for a few different official and unofficial sources of 2FA, on top of manual method which allows you to provide required credentials yourself. Please note that those instructions should be used only if you're already using given solution - since process here involves third-party apps and tools, we do not recommend using them, and we're mentioning it exclusively for people that already decided to use them and would like to import generated details into ASF 2FA.

In general, import process involves dropping maFile in appropriate format to ASF's config directory, upon which ASF will pick up that file and automatically remove it for security reasons.

All following guides require from you to already have working and operational authenticator being used with given tool/application. ASF 2FA will not operate properly if you import invalid data, therefore make sure that your authenticator works properly before attempting to import it. This does include testing and verifying that following authenticator functions work properly:

  • You can generate tokens and those tokens are accepted by Steam network (you can log in with them)
  • You can fetch confirmations, and they are arriving on your mobile authenticator
  • You can react to those confirmations, and they're properly recognized by Steam network as confirmed/rejected

Ensure that your authenticator works by checking if above actions work - if they don't, then they won't work in ASF either.

Android phone

In general for importing authenticator from your Android phone you will need root access. The below instructions require from you fairly decent knowledge in Android modding world, we're definitely not going to explain every step here, visit XDA and other resources for additional information/help with below.

Assuming you have official Steam app working and operational (requires rooting your device):

Now that you've successfully extracted required details, disable the module to prevent the window from showing each time, then copy value of shared_secret and identity_secret of the account that you intend to add to ASF 2FA, into a new text file with below structure:

{
  "shared_secret": "STRING",
  "identity_secret": "STRING"
}

Replace each STRING value with appropriate private key from extracted details. Once you do that, rename the file to BotName.maFile, where BotName is the name of your bot you're adding ASF 2FA to, and put it in ASF's config directory if you haven't yet.

Launch ASF, which should notice your file and import it. Assuming that you've imported the correct file with valid secrets, everything should work properly, which you can verify by using 2fa commands. If you made a mistake, you can always remove Bot.db and start over if needed.

SteamDesktopAuthenticator

If you have your authenticator running in SDA already, you should notice that there is steamID.maFile file available in maFiles folder. Make sure that maFile is in unencrypted form, as ASF can't decrypt SDA files - unencrypted file content should start with { and end with } character. If needed, you can remove the encryption from SDA settings first, and enable it again when you're done. Once the file is in unencrypted form, copy it to config directory of ASF.

You can now rename steamID.maFile to BotName.maFile in ASF config directory, where BotName is the name of your bot you're adding ASF 2FA to. Alternatively you can leave it as it is, ASF will then pick it automatically after logging in. Renaming the file helps ASF by making it possible to use ASF 2FA before logging in, if you don't do that, then the file can be picked only after ASF successfully logs in (as ASF doesn't know steamID of your account before in fact logging in).

Launch ASF, which should notice your file and import it. Assuming that you've imported the correct file with valid secrets, everything should work properly, which you can verify by using 2fa commands. If you made a mistake, you can always remove Bot.db and start over if needed.

WinAuth

Firstly create new empty BotName.maFile in ASF config directory, where BotName is the name of your bot you're adding ASF 2FA to. If you provide incorrect name, it won't be picked by ASF.

Now launch WinAuth as usual. Right click on Steam icon and select "Show SteamGuard and Recovery Code". Then check "Allow copy". You should notice familiar to you JSON structure on the bottom of the window, starting with {. Copy whole text into a BotName.maFile file created by you in previous step.

Launch ASF, which should notice your file and import it. Assuming that you've imported the correct file with valid secrets, everything should work properly, which you can verify by using 2fa commands. If you made a mistake, you can always remove Bot.db and start over if needed.

Manual

If you're advanced user, you can also generate maFile manually. This can be used in case you'd want to import authenticator from other sources than the ones we've described above. It should have a valid JSON structure of:

{
  "shared_secret": "STRING",
  "identity_secret": "STRING"
}

Standard authenticator data has more fields - they're entirely ignored by ASF during import, as they're not needed. You don't need to remove them - ASF only requires valid JSON with 2 mandatory fields described above, and will ignore additional fields (if any). Of course, you need to replace STRING placeholder in the example above with valid values for your account. Each STRING should be base64-encoded representation of bytes the appropriate private key is made of.

ЧаПи

How is ASF making use of 2FA module?

If ASF 2FA is available, ASF will use it for automatic confirmation of trades that are being sent/accepted by ASF. It will also be capable of automatically generating 2FA tokens on as-needed basis, for example in order to log in. In addition to that, having ASF 2FA also enables 2fa commands for you to use.

How can I obtain 2FA token?

You will need 2FA token to access 2FA-protected account, that includes every account with ASF 2FA as well. If you've decided to use standalone authenticator, then you should use 2fa <BotNames> command to generate temporary token for given bot instances. In all other scenarios, we recommend to use original authenticator that you've used, although you can use the command as well if it's more convenient to you.

Can I use my original authenticator after importing it as ASF 2FA?

Yes, your original authenticator remains functional and you can use it together with using ASF 2FA. Keep in mind however that if you invalidate it through any method, then linked ASF 2FA credentials will also no longer be valid.

How to remove ASF 2FA?

Simply stop ASF and remove associated BotName.db of the bot with linked ASF 2FA you want to remove. This option will remove associated imported 2FA with ASF, but will NOT invalidate (unlink) your authenticator. If you instead want to invalidate your authenticator, apart from removing it from ASF (firstly), you should unlink it in original authenticator of your choice. If you can't do that for some reason, for example because you're using ASF 2FA in standalone mode, then use revocation code that you've received during setup, on the Steam website. It's not possible to invalidate your authenticator through ASF.

I linked authenticator in third-party app, then imported to ASF. Can I now link it again on my phone?

No. Doing so will invalidate the previously imported credentials and your ASF 2FA will stop functioning (by generating codes no longer being accepted by Steam). Firstly decide where you want to have your original or third-party authenticator located, then import it as ASF 2FA.

Is using ASF 2FA better than third-party authenticator set to accept all confirmations?

Yes, in several ways. First and most important one - using ASF 2FA significantly increases your security, as ASF 2FA module ensures that ASF will only accept automatically its own confirmations, so even if attacker does request a trade that is harmful, ASF 2FA will not accept such trade, as it was not generated by ASF. In addition to security part, using ASF 2FA also brings performance/optimization benefits, as ASF 2FA fetches and accepts confirmations immediately after they're generated, and only then, as opposed to inefficient polling for confirmations each X minutes which is achieved by other solutions. There is no reason to use third-party authenticator over ASF 2FA, if you plan on automating confirmations generated by ASF - that's exactly what ASF 2FA is for, and using it does not conflict with you confirming everything else in authenticator of your choice. We strongly recommend to use ASF 2FA for entire ASF activity.

en-US de-DE es-ES lol-US
pt-BR ru-RU zh-CN zh-TW

👨‍🏫 Основи

👨‍🎓️ Головне

🧙 Поглиблене

👷 Розробникам

Clone this wiki locally