The work this is built on
ODA depends on public libraries and protocol research from other developers. DoctorMcKay's Steam libraries provide a shipped sign-in dependency, test references and inspectable examples of Steam's authentication and confirmation flows. The specific relationships are listed below.
DoctorMcKay has maintained the open-source Steam libraries for years under the MIT licence. His donation page explains how contributions support his open-source work.
Donate to him →What we actually use#
Stated precisely, because vague gratitude is worth less than an accurate account of the debt:
-
steam-session Shipped in the application
The library that performs the sign-in to Steam. This is not inspiration or a reference — it is a dependency listed in our
package.json, running in the application. ODA uses it for the Steam authentication exchange. -
steam-totp What our own code is checked against
Generates the five-character Steam Guard code from a
shared_secret, and the confirmation key from anidentity_secret. We implement both ourselves. CI compares code generation againststeam-totpin the spike tests; the confirmation-key tests use recorded vectors produced by that library. A disagreement needs investigation, not an assumption that either implementation is infallible. -
steamcommunity A public protocol reference
Its mobile confirmation implementation is a useful public reference for request shapes and signing conventions. ODA's confirmation client is implemented locally;
steamcommunityis not a shipped dependency. This credits a reference without claiming that one library is the origin of every independent authenticator.
Why this matters more than a credits line#
Everything on this site argues the same point: that you should not have to trust a stranger with the keys to your Steam account, because you can check the thing instead. That argument only works if there is something to check — an alternative that is open, inspectable and not the only game in town.
Public implementations let developers compare results, identify mistakes and build compatible tools. Credit should identify the code actually used and the research consulted; it should not imply that the upstream maintainer reviewed or endorses every downstream application.
The MIT licence permits reuse, including commercial reuse, subject to its notice requirements. It does not require a donation. We do not know the maintainer's total funding or employment arrangements; our reason to link his donation page is the value of the work we use.
Donate to him directly#
These destinations match the links on his donation page, checked on 12 September 2026. Payments do not pass through ODA. The payment platform or network may charge fees; check its terms and the destination before sending.
He explains that donations help him continue his open-source work. His page is at dev.doctormckay.com/donate, and his repositories are at github.com/DoctorMcKay.
To be completely clear about what this page is#
Open Desktop Authenticator is an independent project. It is not affiliated with, endorsed by, or connected to DoctorMcKay. We do not claim his review or approval. We link to him because we depend on his work, not because he vouches for ours. Verify the addresses on his own donation page before sending anything — including the links above, and including because we said so.
If you would rather support this project#
Consider him first; the dependency runs one way. If you still want to, the donations page explains what it pays for.