"The account name or password that you have entered is incorrect" Steam Api error

Question

I got "The account name or password that you have entered is incorrect" error when trying login using this api endpoint: https://steamcommunity.com/login/dologin/

I am using the credentials I use when logging in via Steam app or Steam web, so I don't think I have a problem with my credentials.

Here code which code I use:

public bool DoLogin(string username, string password)
{
    var data = new NameValueCollection { { "username", username } };
    // First get the RSA key with which we will encrypt our password.
    string response = Fetch("https://steamcommunity.com/login/getrsakey", "POST", data, false);
    GetRsaKey rsaJson = JsonConvert.DeserializeObject<GetRsaKey>(response);

    // Validate, if we could get the rsa key.
    if (!rsaJson.success)
    {
        return false;
    }

    // RSA Encryption.
    RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
    RSAParameters rsaParameters = new RSAParameters
    {
        Exponent = HexToByte(rsaJson.publickey_exp),
        Modulus = HexToByte(rsaJson.publickey_mod)
    };

    rsa.ImportParameters(rsaParameters);

    // Encrypt the password and convert it.
    byte[] bytePassword = Encoding.ASCII.GetBytes(password);
    byte[] encodedPassword = rsa.Encrypt(bytePassword, false);
    string encryptedBase64Password = Convert.ToBase64String(encodedPassword);

    SteamResult loginJson = null;
    CookieCollection cookieCollection;
    string steamGuardText = "";
    string steamGuardId = "";

    // Do this while we need a captcha or need email authentification. Probably you have misstyped the captcha or the SteamGaurd code if this comes multiple times.
    do
    {
        Console.WriteLine("SteamWeb: Logging In...");

        bool captcha = loginJson != null && loginJson.captcha_needed;
        bool steamGuard = loginJson != null && loginJson.emailauth_needed;

        string time = Uri.EscapeDataString(rsaJson.timestamp);

        string capGid = string.Empty;
        // Response does not need to send if captcha is needed or not.
        // ReSharper disable once MergeSequentialChecks
        if (loginJson != null && loginJson.captcha_gid != null)
        {
            capGid = Uri.EscapeDataString(loginJson.captcha_gid);
        }

        data = new NameValueCollection { { "password", encryptedBase64Password }, { "username", username } };

        // Captcha Check.
        string capText = "";
        if (captcha)
        {
            Console.WriteLine("SteamWeb: Captcha is needed.");
            System.Diagnostics.Process.Start("https://steamcommunity.com/public/captcha.php?gid=" + loginJson.captcha_gid);
            Console.WriteLine("SteamWeb: Type the captcha:");
            string consoleText = Console.ReadLine();
            if (!string.IsNullOrEmpty(consoleText))
            {
                capText = Uri.EscapeDataString(consoleText);
            }
        }

        data.Add("captchagid", captcha ? capGid : "-1");
        data.Add("captcha_text", captcha ? capText : "");
        // Captcha end.
        // Added Header for two factor code.
        data.Add("twofactorcode", "");

        // Added Header for remember login. It can also set to true.
        data.Add("remember_login", "false");

        // SteamGuard check. If SteamGuard is enabled you need to enter it. Care probably you need to wait 7 days to trade.
        // For further information about SteamGuard see: https://support.steampowered.com/kb_article.php?ref=4020-ALZM-5519&l=english.
        if (steamGuard)
        {
            Console.WriteLine("SteamWeb: SteamGuard is needed.");
            Console.WriteLine("SteamWeb: Type the code:");
            string consoleText = Console.ReadLine();
            if (!string.IsNullOrEmpty(consoleText))
            {
                steamGuardText = Uri.EscapeDataString(consoleText);
            }
            steamGuardId = loginJson.emailsteamid;

            // Adding the machine name to the NameValueCollection, because it is requested by steam.
            Console.WriteLine("SteamWeb: Type your machine name:");
            consoleText = Console.ReadLine();
            var machineName = string.IsNullOrEmpty(consoleText) ? "" : Uri.EscapeDataString(consoleText);
            data.Add("loginfriendlyname", machineName != "" ? machineName : "defaultSteamBotMachine");
        }

        data.Add("emailauth", steamGuardText);
        data.Add("emailsteamid", steamGuardId);
        // SteamGuard end.

        // Added unixTimestamp. It is included in the request normally.
        var unixTimestamp = (int)(DateTime.UtcNow.Subtract(new DateTime(1970, 1, 1))).TotalSeconds;
        // Added three "0"'s because Steam has a weird unix timestamp interpretation.
        data.Add("donotcache", unixTimestamp + "000");

        data.Add("rsatimestamp", time);

        // Sending the actual login.
        using (HttpWebResponse webResponse = Request("https://steamcommunity.com/login/dologin/", "POST", data, false))
        {
            var stream = webResponse.GetResponseStream();
            if (stream == null)
            {
                return false;
            }
            using (StreamReader reader = new StreamReader(stream))
            {
                string json = reader.ReadToEnd();
                loginJson = JsonConvert.DeserializeObject<SteamResult>(json);
                cookieCollection = webResponse.Cookies;
            }
        }
    } while (loginJson.captcha_needed || loginJson.emailauth_needed);

    // If the login was successful, we need to enter the cookies to steam.
    if (loginJson.success)
    {
        _cookies = new CookieContainer();
        foreach (Cookie cookie in cookieCollection)
        {
            _cookies.Add(cookie);
        }
        SubmitCookies(_cookies);
        return true;
    }
    else
    {
        Console.WriteLine("SteamWeb Error: " + loginJson.message);
        return false;
    }

}

enter image description here

Is there another solution how to login to steam and get html?

Answer 1

Ok, so I checked your encrypting and it looks fine. It is a little bit of chaos in your code so i will explain it with my:

I prefer to use RestSharp and Newton Soft JSON to do this, so a little mandatory stuff in Class body:

 private IRestClient restClientTemporary;
 private string getKeysURL = "/login/getrsakey/";
 private string loginWithKey = "/login/dologin/";

Create RestClient, and RestRequests:

restClientTemporary = new RestClient("https://steamcommunity.com");
var request = new RestRequest(getKeysURL, Method.POST);
request.AddParameter("username", "YourSteamLogin");

var resp = restClientTemporary.Execute(request);
GetRsaResult response = Newtonsoft.Json.JsonConvert.DeserializeObject<GetRsaResult>(resp.Content);

Then i used your code as method to encrypt:

    public static string EncryptionSof(string password, GetRsaResult response)
        {
            RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
            RSAParameters rsaParameters = new RSAParameters
            {
                Exponent = HexToByte(response.publickey_exp),
                Modulus = HexToByte(response.publickey_mod)
            };

            rsa.ImportParameters(rsaParameters);

            // Encrypt the password and convert it.
            byte[] bytePassword = Encoding.ASCII.GetBytes(password);
            byte[] encodedPassword = rsa.Encrypt(bytePassword, false);
            return Convert.ToBase64String(encodedPassword);
        }

And then used this method:

string password = EncryptionSof("admin123/*its your steam password i think*/", response);

Next step is make request to get login data:

var loginRequest = new RestRequest(loginWithKey);
loginRequest.AddParameter("username", "YourSteamLogin");
loginRequest.AddParameter("password", password);
loginRequest.AddParameter("rsatimestamp", response.timestamp);
loginRequest.AddParameter("remember_login", false);
//Captcha stuff if needed:
loginRequest.AddParameter("captchagid", 3086601225255895896);
loginRequest.AddParameter("captcha_text", "LHYJ2P");

And finally execute it:

var responseFinal = restClientTemporary.Execute(loginRequest);

In response i received everything i need in responseFinal.Content:

{
   "success":true,
   "requires_twofactor":false,
   "login_complete":true,
   "transfer_urls":[
      "https:\\/\\/store.steampowered.com\\/login\\/transfer",
      "https:\\/\\/help.steampowered.com\\/login\\/transfer"
   ],
   "transfer_parameters":{
      "steamid":"12344567898765432",
      "token_secure":"xDDDDDDDDD",
      "auth":"LOOOOOL",
      "remember_login":false
   }
}

GetRsaResult model looks like:

    public class GetRsaResult
    {
        public bool success { get; set; }
        public string publickey_mod { get; set; }
        public string publickey_exp { get; set; }
        public string timestamp { get; set; }
        public string token_gid { get; set; }
    }

Ah, and i forget about changing 16-string to byte[], its method found on Stackoverflow:

public static byte[] HexToByte(string hex)
        {
            return Enumerable.Range(0, hex.Length)
                             .Where(x => x % 2 == 0)
                             .Select(x => Convert.ToByte(hex.Substring(x, 2), 16))
                             .ToArray();
        }

And you have to remember one thing You never want to send plaintext password to steam. First request /login/getrsakey/ is just only for get keys to encrypt password. Steam gives you key to encrypt your password. So, you will use your plaintext password (in my sample its admin123 ) in your program to encrypt it with keys you received from Steam.

In second request /login/dologin/ you must send encrypted password (result of EncryptionSoF method)