Something went wrong. Try again.
currently proxies requests for owned games, since that is hidden behind a steam developer key and not entirely public
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536# Copy this to config.toml, fill in real values, then `chmod 600 config.toml`.[server]bind_addr = "127.0.0.1:8095"[steam]# Get a key at https://steamcommunity.com/dev/apikey# By using it you agree to https://steamcommunity.com/dev/apitermsapi_key = "REPLACE_WITH_YOUR_STEAM_WEB_API_KEY"# Buffer under Valve's default 100,000 calls/day cap.daily_limit = 90000# Sent as the User-Agent header on every call to the Steam Web API. Steam's# dev page asks integrators to be identifiable; put whatever app name/contact# info you're comfortable making public here (this is never returned to# callers of this service, only sent to Steam). Leave generic if publishing# this source tree so no personal info is baked into the binary.user_agent = "steamapi-app/0.1"[auth]# Shared secret callers must send as the X-Api-Token header.token = "REPLACE_WITH_A_LONG_RANDOM_TOKEN"[quota]# Persists the daily call tally across restarts. Relative to the working# directory the process is started from.state_file = "state.json"[cors]# Origins allowed to call this API cross-origin from browser JS (sets# Access-Control-Allow-Origin, and handles the OPTIONS preflight). Exact# match, no trailing slash, e.g. "https://example.com". Note that since# these calls come straight from browser JS, the X-Api-Token above is# necessarily visible to anyone who opens devtools on that site — it's a# deterrent against casual scraping, not a hard secret, once listed here.allowed_origins = ["https://REPLACE_WITH_YOUR_FRONTEND_ORIGIN"]