steamguard-cli: Steam 2FA codes and confirmations from a Linux terminal

A 2FA generator for a machine with no phone attached

steamguard-cli is a command line utility for setting up and using the Steam Mobile Authenticator, which is what Steam calls its 2FA. Beyond producing a login code, it can respond to trade, market and any other Steam mobile confirmations that you would normally tap in the phone app. The audience is specific and worth naming, because the tool is not trying to be a general authenticator. It is for a Linux machine that runs Steam without a desktop session, for a Steam Deck that needs a quick QR code login, and for a CI/CD pipeline that has to confirm a purchase before a game build can be published. The project page names a sample use: an Unreal Engine to Steam publishing pipeline, together with a CI runner project. The word utility in the project description is accurate, since the interface is a set of subcommands and one-liners rather than a window, and the entry point binary is named steamguard even though the package is steamguard-cli.

maFiles, an encrypted store, and a keyring that can hold the passkey

The data flow starts with the shared secret that Steam Desktop Authenticator calls maFiles. steamguard-cli looks for a manifest.json inside a maFiles directory, and it searches several paths in a defined order so that a file exported from another authenticator can simply be dropped into place. On Linux the search order is ~/.config/steamguard-cli/maFiles/ and then ~/maFiles/, and on Windows it is %APPDATA%\steamguard-cli\maFiles/ followed by %USERPROFILE%\maFiles/. The project states that it can read Steam Desktop Authenticator's maFiles format, and that its own files can be created with or imported from that tool. Two things surround the secret. The secrets are stored encrypted, and the encryption passkey can optionally be kept in the system keyring rather than typed in every time. The dependency list shows how that is built: the aes crate is pulled in with the zeroize feature, the secrecy crate is present for keeping sensitive values out of easy reach, and zeroize is used directly so that the secret bytes are wiped from memory rather than left until the allocator reuses it. The feature list describes the same intent with its own words, special memory-clearing data structures to prevent leaking secrets.

The Cargo manifest tells you what the program is made of

The dependency set in Cargo.toml describes a program that talks to Steam over HTTPS and prints to a terminal. reqwest is configured with blocking, json, cookies, gzip and rustls-tls features, so the client is a synchronous HTTP client with a cookie jar, which is what a session-based login flow needs. The rsa crate is there for the key exchange with Steam's servers, and the uuid crate provides identifiers. The command line is built with clap 4.5.4 using the derive, cargo and env features, with clap_complete available for shell completion, and log plus stderrlog 0.6 handle diagnostics on standard error so that piping standard output to a clipboard tool stays clean. The Cargo manifest also exposes a features table, and the defaults are the interesting part, because a downstream packager can turn parts of the program off: Three features are on by default. qr pulls in the qrcode crate so that a secret can be printed as a scannable image, updater pulls in update-informer so the program can tell you a newer release exists, and keyring pulls in the keyring crate for system keyring access. Building without the keyring feature removes the option of storing the encryption passkey in the system keyring, and building without qr removes the QR code workflow, which matters for a minimal container image. The package version in the manifest is 0.18.4, matching the most recent release tag, and the edition is 2021. The workspace has a single member, the steamguard library, which the program depends on by both version and local path.

[features]
default = ["qr", "updater", "keyring"]
qr = ["dep:qrcode"]
updater = ["dep:update-informer"]
keyring = ["dep:keyring"]

Installing it and getting a first code out

If you already have the Rust toolchain, the shortest path is a single command, and the project lists it as the install method for people with cargo available:

cargo install steamguard-cli

That builds the release binary and puts the steamguard command on your path. Arch based systems have two AUR packages instead, one called steamguard-cli that tracks the latest release and one called steamguard-cli-git that tracks the latest git commit. If you would rather not build it yourself, the project points to the binaries in the releases section of the repository. Building from the source tree is the same toolchain with a different target:

cargo build --release

From there the program is a set of actions, and the setup action creates the maFiles for you rather than requiring an import from another authenticator. The full helptext lists every action:

steamguard --help

Once an account is set up, the shortest useful run prints a code and hands it to the clipboard through xclip, which is the pattern the project itself shows for a script or a bind key:

steamguard | xclip -selection clipboard

The project text also warns readers to back up the maFiles and to write down the recovery code, and the disclaimer in the same document is blunt: the utility is effectively in beta, use it at your own risk, and if you lose both the backup and the revocation code the only recourse is Steam support. That is the correct expectation to set before you connect a valuable trading account to it.

QR codes move the secret, but two popular authenticators reject it

One feature deserves its own caution because it fails in a way that is easy to misdiagnose. steamguard-cli can generate a QR code for your 2FA secret so that a password manager such as KeeWeb can hold it, and it can generate QR code logins so a new device, the Steam Deck named in the project text, can be signed in quickly. The practical reading is that the QR feature is a transport, not a guarantee. The format flag has to match the receiving application, and a mismatch produces codes that look plausible and are rejected at the Steam login screen, which is a confusing failure to debug if you do not know the two applications in the caution list exist. The default format is the one used by the password managers the project names as the intended destination, and the flags exist for the two that need their own variant.

steamguard qr --format bitwarden # Bitwarden compatible format
steamguard qr --format keepassxc # KeePassXC compatible format

How this differs from the desktop authenticator it reads from

The real alternative for most people is not another command line tool, it is the desktop authenticator the project already integrates with. Steam Desktop Authenticator works with the same maFiles and the same shared secret, and steamguard-cli can read its maFiles format, which means you can migrate rather than re-enroll, and you can keep both tools pointed at the same files. The difference in approach is where each one runs. The desktop application needs a display and a person; the command line program needs a terminal and can be invoked by a script, a cron entry or a CI job, and it can answer a trade confirmation without anyone present. Its response path goes through the same official Steam APIs the project says it prefers, with the stated intention of being unlikely to break. The trade-off runs the other way as well. The desktop authenticator is the origin of the format and the usual place to make a backup, while this project states plainly that it is effectively in beta and asks users to back up maFiles and write down the revocation code by hand. Anyone considering the switch should keep the graphical tool around for the recovery path rather than treating the two as interchangeable.

Release rhythm, licence split and the cost of a rust toolchain

The repository is not archived and the last push was on 2026-09-22, with three releases in quick succession in July 2026: v0.18.2 on 2026-07-11, v0.18.3 on 2026-07-12 and v0.18.4 on 2026-07-16. The cadence suggests a project that ships small fixes often rather than on a schedule, and the version in Cargo.toml tracks the latest tag. Licensing is split in a way that matters if you want to reuse the code. The command line program steamguard-cli is licensed under GPLv3, and the Cargo manifest states the same identifier as GPL-3.0-or-later. The library it depends on, named steamguard, is dual licensed under MIT or Apache 2.0 at your option, which is the permissive half of the project and is the part worth looking at if you want to embed the protocol handling in another program rather than shell out. The contributing section adds a clause that is unusual and worth reading before sending a patch: by contributing code you grant a non-exclusive transferable license to use that code for the project, including permission to modify, redistribute and relicense it. This is a licensing note rather than legal advice, and the LICENSE file holds the actual terms.

Editorial conclusion

Adopt steamguard-cli if you run Steam on a headless Linux box, on a Steam Deck, or inside a CI pipeline that needs to confirm a market purchase, and if you are willing to own the backup discipline the project insists on. Do not adopt it as a phone authenticator replacement, since the project itself warns that the utility is effectively in beta. Verify first that cargo install steamguard-cli resolves, that the setup action writes a manifest.json into ~/.config/steamguard-cli/maFiles/, that you have written down the revocation code somewhere outside the machine, and that a copied backup of the maFiles directory exists before you rely on this for a trading account.

Frequently asked questions

Official sources

1. dyc3/steamguard-cli on GitHub
2. Issues
3. License: GPL-3.0
4. README
5. Releases