How to Set Up Steam Guard Mobile Authenticator: Recovery Codes, Trade Holds and Windows Security

What you need first​

• A phone running the official Steam Mobile app. Several how-to guides warn against unofficial apps that claim to generate Steam Guard codes. Avoid unofficial apps claiming to generate Steam Guard codes.
• Access to the Steam account's email address.
• A phone number that can receive an SMS. Guides generally have you verify one during setup. Valve's own documentation, as summarized in the research notes for this story, says a number isn't strictly required. In that case you choose the "I don't have access to a phone number" option. I couldn't open that page directly, so treat this as a detail to confirm on screen.
• Somewhere safe, and separate from the phone, to keep a recovery code.

Setup, step by step​

The shattered.io guide tells readers to tap "Set Up Steam Guard Mobile Authenticator". Other current guides describe a different label. Install the official Steam Mobile app, sign in to your Steam account, open Steam Guard and choose Add authenticator. The button wording can vary between app versions, so go by what your app shows.

1. Install and sign in. Get the Steam Mobile app from your platform's official store and sign in to the account you want to protect. If you own more than one Steam account, check the account name carefully before continuing.
2. Open Steam Guard. Depending on the app layout, this appears as a shield icon or as an item in the main menu.
3. Choose Add authenticator. Enter or confirm your phone number if prompted.
4. Enter the SMS code. Request another code only after checking that the number and country code are correct. Carrier delays are common, so don't hammer the resend button.
5. Save the recovery code. This is the most important step. Store it in a password manager or another secure place that is not available only from the same phone. A screenshot in a photo roll that syncs to the cloud defeats the point.
6. Finish and test. Verify that Steam Guard can display a login code or accept a sign-in request. A good test is to sign out on your PC and sign back in.

What success looks like​

Once the authenticator is active, the app shows a Steam Guard code that refreshes periodically. When the mobile authenticator is successfully enabled, you'll be presented with a unique Steam Guard code that will periodically refresh. The app can also scan a Steam login QR code and present approval prompts. It can generate rotating codes, scan a Steam login QR code, and present approval prompts. That makes it more than a code generator, a point the shattered.io guide undersells.

Where the shattered.io guide needs correcting​

I'd flag four points for readers.

• The recovery code isn't literally the only way back in. The guide says the code is the only route if you lose the phone. Valve's documentation, per the research notes, also describes SMS-based transfer or recovery when you keep your phone number. It also describes recovery through Steam Support. Treat the recovery code as your fastest and best route, not your only one.
• Trade restrictions are more nuanced than "the hold resets." The guide says trade holds reset after a password change or after you enable the authenticator. That lumps separate rules together. One rule that independent coverage confirms: According to the official Steam Support guidelines, Steam Guard must have been enabled for 15 days before an account can trade and use the Community Market without restrictions. The research notes add more detail from Valve's restrictions page. Password resets, removing the authenticator and transferring it to a new phone can each trigger their own waiting period. Steam shows the restriction that applies to your account, so check that rather than assuming a number.
• Setup doesn't instantly unlock trading. If you enable the authenticator hoping to clear an existing hold, don't expect it to. The notes say holds already in effect aren't shortened by adding it.
• The October 7 "refresh" claim isn't verified. The guide says Steam Support updated its Account Security Recommendations on that date and shifted its emphasis. I couldn't confirm that date or the change from a dated primary source, so I'm not repeating it as fact. The underlying advice is still sound: review authorized devices, sign out unknown sessions, and scan the PC for malware.

Troubleshooting the usual failures​

• Codes are rejected. The usual cause is phone clock drift, since time-based codes depend on an accurate clock. Turn on automatic date and time on the phone and try again.
• The SMS never arrives. Check the number and country prefix, wait a few minutes, then request one more code.
• You're replacing your phone. Move the authenticator while you still have the old phone and number. The notes say that removing it afterward carries a longer trading and Market restriction than a transfer does.
• You've lost the phone and the code. Go through official Steam Support only. Fake "support" accounts on Discord or social media love this moment. Nobody legitimate will ask for your authenticator code, SMS recovery code or password.

The Windows angle: the authenticator doesn't fix a dirty PC​

The shattered.io guide makes a fair point. Two-factor protection guards the login moment, while infostealer malware can lift an already-authenticated session from a browser or app on the PC. That is why scanning a Windows machine matters as much as enabling the authenticator. The guide also warns against cracked mods, "free" cheat tools and FPS-boost utilities that ask you to disable antivirus. That is a reasonable red flag. Its claims about how common infostealers are in 2026 come from the guide itself. I couldn't independently verify them here, so weigh them accordingly.

A sensible order for a Windows gamer:

1. Run a full scan with Microsoft Defender or your preferred security tool.
2. Remove browser extensions you don't recognize.
3. Change the Steam and email passwords from the clean machine.
4. Deauthorize unknown devices and sign out other sessions in Steam.
5. Set up the authenticator and store the recovery code.

Bottom line​

For most players, Steam Guard Mobile Authenticator is the best protection Steam offers for an account. Install the official app, choose Add authenticator, verify via SMS, and save the recovery code off the phone. Then test a sign-in. Don't believe any guide, including this one, that promises a fixed trade-hold timer. Steam's trade-restriction status on your own account is the authority.