I asked ChatGPT to suggest a hardware key that could be used to provide TOTP to unlock my Steam account on my SteamDeck (The steam account credentials unlock the device itself, not merely the steam application). I’ll paste what it said below but my two main questions are: -
- Can the OnlyKey truly generate TOTPs for Steam Guard given that they are non standard codes?
- Can the OnlyKey pass the TOTPs to the Steam Deck login screen (via USB) given that it will be essentially “offline” at that moment with no access to an app to set or confirm the time (I’m sure Steam OS (Arch linux derivative) can run the app, but at the moment of use, it’s locked behind a login screen)
Here follow ChatGPT’s comments:
***
Steam Guard’s “mobile” codes are not standard RFC-6238 TOTP:
- 5 characters (not 6–8 digits)
- Custom character set (letters + numbers)
- Steam-specific truncation logic
Most hardware TOTP tokens (YubiKey in OTP mode, generic keyfobs, bank tokens, etc.) only support:
- 6–8 numeric digits
- Fixed algorithms
- No custom alphabet
That means 99% of hardware tokens will never work with Steam, even if you load the secret.
What can work
1. Programmable hardware tokens (rare but real)
You need a device that allows:
- Custom TOTP parameters
- Custom alphabet / encoding
- Or firmware-level flexibility
The standout option today:
OnlyKey
- Open-source firmware
- Supports Steam-style OTP
- Can store the Steam
shared_secret - Works offline
- USB + keychain form factor
***