HTTP 400 Error using getNotifications()

[DerErzengel]

Using the getNotifications() method gives me an HTTP Error 400.
My code is this (only intended for rough functionality testing):

const SteamCommunity = require('steamcommunity');
const SteamTotp = require('steam-totp');
let community = new SteamCommunity();

var accountName = accounts["bots"]["name"];
var accountPassword = accounts["bots"]["password"];
var accountSecret = accounts["bots"]["secret"];

community.login({
    accountName: accountName,
    password: accountPassword,
    twoFactorCode: accountSecret ? SteamTotp.generateAuthCode(accountSecret) : undefined
}, async (err) => {
    if (err) {
        throw err;
    }
    community.loggedIn(async (err, loggedIn) => {
        if (err) {
            throw err;
        } 
        if (loggedIn) {
            console.log("Successfully logged in");
            community.getTradeURL(async (err, url) => {
                if(err) {
                    console.log(err);
                }
                console.log(url);
            });
            community.getNotifications(async (err, notifications) => {
                if (err) {
                    console.log("Error", err);
                } else {
                    console.log("Notification: ", notifications);
                }
                
            });
        }
    });
    
});

But i seem to be logged in, because the module successfully displays the tradeurl of the account on the console, which is only executed inside the loggedIn Method.

Error: HTTP error 400
    at SteamCommunity._checkHttpError (C:\...\node_modules\steamcommunity\components\http.js:108:9)
    at Request._callback (C:\...\node_modules\steamcommunity\components\http.js:50:61)
    at self.callback (C:\...\node_modules\steamcommunity\node_modules\request\request.js:185:22)
    at Request.emit (node:events:524:28)
    at Request.<anonymous> (C:\...\node_modules\steamcommunity\node_modules\request\request.js:1154:10)
    at Request.emit (node:events:524:28)
    at Gunzip.<anonymous> (C:\...\node_modules\steamcommunity\node_modules\request\request.js:1076:12)
    at Object.onceWrapper (node:events:638:28)
    at Gunzip.emit (node:events:524:28)
    at endReadableNT (node:internal/streams/readable:1698:12) {
  code: 400
}
https://steamcommunity.com/tradeoffer/new/?partner=17XXXXX701&token=_XXXXX

[DerErzengel]

Even if I manually use the URL https://steamcommunity.com/actions/GetNotificationCounts which getNotifications() uses in my own browser, I get a 400 bad request (with steam logged in).
I guess steam has changed something in the function, or does it work for you?

[DerErzengel]

is there anyone who has the same problem?

[Revadike]

I think Steam deactivated this endpoint. It currently uses the new API method:

const baseURL = "https://api.steampowered.com/ISteamNotificationService/GetSteamNotifications/v1";

const inputJson = {
  include_hidden: false,
  language: 0,
  include_confirmation_count: false,
  include_pinned_counts: true,
  include_read: false,
  count_only: false,
};

const url = new URL(baseURL);
url.searchParams.set("access_token", YOUR_PERSONAL_WEB_ACCESS_TOKEN_HERE);
url.searchParams.set("origin", "https://steamcommunity.com");
url.searchParams.set("input_json", JSON.stringify(inputJson));

const response = await fetch(url.toString(), {
    "credentials": "omit",
    "headers": {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0",
        "Accept": "*/*",
        "Accept-Language": "en-US,en;q=0.5",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "cross-site",
        "Priority": "u=4"
    },
    "referrer": "https://steamcommunity.com/",
    "method": "GET",
    "mode": "cors"
});

const json = await response.json();

console.log(json);
/* 
{
  "response": {
    "notifications": [
      {
        "notification_id": "90832180423",
        "notification_targets": 3,
        "notification_type": 3,
        "body_data": "{\"owner_steam_id\":\"103582791435030951\",\"bclan_account\":1,\"forum_id\":\"611696927926638786\",\"topic_id\":\"591759409446669228\",\"thread_id\":\"540414364\",\"type\":\"7\",\"account_id\":68197038,\"subscribed\":0,\"last_post\":1735903167,\"text\":\"Public Forum\",\"title\":\"Comment page for Recent Removals Week 1 2025\",\"bhas_friend\":0,\"bis_forum\":1,\"bis_owner\":0,\"cgid\":\"0\"}",
        "read": false,
        "timestamp": 1735903167,
        "hidden": false,
        "expiry": 0,
        "viewed": 1735910535
      },
      {
        "notification_id": "90834276217",
        "notification_targets": 3,
        "notification_type": 5,
        "body_data": "{\"requestor_id\":1487476470,\"state\":2}",
        "read": false,
        "timestamp": 1735905289,
        "hidden": false,
        "expiry": 0,
        "viewed": 1735910535
      }
    ],
    "pending_gift_count": 0,
    "pending_friend_count": 1,
    "unread_count": 2,
    "pending_family_invite_count": 0
  }
}
*/

Unfortunately, node-steamcommunity currently has no way to retrieve the web access token. It should do this, since more and more API endpoints will move to the new API system. One way is to use this endpoint, which surprisingly still works in obtaining your web access token. I don't know how @DoctorMcKay wants to implement this, so I'll leave that up to him. I bet this is something you want to do for #230 .

[DerErzengel]

Thanks for your help! As far as i know, is the web access token included in the Cookies. Could node-steamcommunity get the Access Token from there?

[Revadike]

Thanks for your help! As far as i know, is the web access token included in the Cookies. Could node-steamcommunity get the Access Token from there?

If that's true, then yes.

[DerErzengel]

I think Steam deactivated this endpoint. It currently uses the new API method:

const baseURL = "https://api.steampowered.com/ISteamNotificationService/GetSteamNotifications/v1";

const inputJson = {
  include_hidden: false,
  language: 0,
  include_confirmation_count: false,
  include_pinned_counts: true,
  include_read: false,
  count_only: false,
};

const url = new URL(baseURL);
url.searchParams.set("access_token", YOUR_PERSONAL_WEB_ACCESS_TOKEN_HERE);
url.searchParams.set("origin", "https://steamcommunity.com");
url.searchParams.set("input_json", JSON.stringify(inputJson));

const response = await fetch(url.toString(), {
    "credentials": "omit",
    "headers": {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0",
        "Accept": "*/*",
        "Accept-Language": "en-US,en;q=0.5",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "cross-site",
        "Priority": "u=4"
    },
    "referrer": "https://steamcommunity.com/",
    "method": "GET",
    "mode": "cors"
});

const json = await response.json();

console.log(json);
/* 
{
  "response": {
    "notifications": [
      {
        "notification_id": "90832180423",
        "notification_targets": 3,
        "notification_type": 3,
        "body_data": "{\"owner_steam_id\":\"103582791435030951\",\"bclan_account\":1,\"forum_id\":\"611696927926638786\",\"topic_id\":\"591759409446669228\",\"thread_id\":\"540414364\",\"type\":\"7\",\"account_id\":68197038,\"subscribed\":0,\"last_post\":1735903167,\"text\":\"Public Forum\",\"title\":\"Comment page for Recent Removals Week 1 2025\",\"bhas_friend\":0,\"bis_forum\":1,\"bis_owner\":0,\"cgid\":\"0\"}",
        "read": false,
        "timestamp": 1735903167,
        "hidden": false,
        "expiry": 0,
        "viewed": 1735910535
      },
      {
        "notification_id": "90834276217",
        "notification_targets": 3,
        "notification_type": 5,
        "body_data": "{\"requestor_id\":1487476470,\"state\":2}",
        "read": false,
        "timestamp": 1735905289,
        "hidden": false,
        "expiry": 0,
        "viewed": 1735910535
      }
    ],
    "pending_gift_count": 0,
    "pending_friend_count": 1,
    "unread_count": 2,
    "pending_family_invite_count": 0
  }
}
*/

Unfortunately, node-steamcommunity currently has no way to retrieve the web access token. It should do this, since more and more API endpoints will move to the new API system. One way is to use this endpoint, which surprisingly still works in obtaining your web access token. I don't know how @DoctorMcKay wants to implement this, so I'll leave that up to him. I bet this is something you want to do for #230 .

I've just gone through your suggestion again. Could it be that the proposed endpoint contains significantly less information?
According to the WIki description, getNotifications can even return notification of new items.
That's not possible with your endpoint, is it?
Is there any other way to get the notifications about new inventory items?

[Revadike]

If it's possible currently in Steam, then yes.