How to use SteamTools manifest & Lua files

This page explains the generator on steamtools.games: type a game name or App ID, download a ZIP (Lua + key.vdf + README), then use those files with the SteamTools desktop client. The website itself needs no signup. You still need to install SteamTools on your computer before the files do anything useful.

1. You type a game name

The input box on the home page debounces your keystrokes by 250 ms and then asks our /api/search endpoint for a short list of matches. The endpoint proxies Steam's public store search and returns the top five results, each with the App ID, the display name, and a small capsule image.

There is no local index. Every search is a live round-trip to Steam. We do not cache search results in a database because Steam's catalogue is large enough that the cache hit rate would be low, and stale results would be worse than no cache.

If you already know the App ID — and you should, because finding it is a 30-second job for any game on Steam — paste it directly into the input box. The generator detects a 4–10 digit number, disables the search dropdown, and lets you skip straight to step 3.

2. You pick a result

Clicking a result in the dropdown sets two hidden state values: the App ID (an integer) and the game name. The input box updates to the display name, and the "Generate" button becomes enabled.

The dropdown is keyboard-navigable. Arrow keys move the highlight, Enter selects, Escape closes it. The first result is pre-highlighted so a quick Enter picks the top hit.

If the search returns zero results, the dropdown shows a "no matches" hint with a link to the app-id finder and a link to the FAQ entry for "my game is not in the list".

3. The generate request

Clicking Generate sends a POST /api/generate request with the App ID (and an optional branch name — useful for Steam beta branches). The endpoint:

1. Validates that the App ID is a positive integer in the legal range (1 to 2,147,483,647).
2. Calls Steam's appdetails endpoint to confirm the game actually exists and to fetch the canonical name and capsule image. This is the one and only place we touch Steam's API for the generate flow.
3. Reads the depot list for the requested branch from Steam's appinfo interface, picks the latest public build for each depot, and resolves the matching depot decryption keys.
4. Renders the manifest text and the Lua script text from those values.
5. Returns both files inline as text/plain so the browser can save them with the correct filenames without any server-side state.

The whole round-trip usually takes 200–400 ms on a warm edge and up to 1.2 s on a cold one (the first request after a Cloudflare cache eviction). If you ever see it take longer than 3 s, the Steam appdetails endpoint is the bottleneck, not us.

4. You download the ZIP and place the files

The result card offers Download ZIP (recommended) plus optional direct links for the Lua file and key.vdf. The ZIP is named like appmanifest_<APPID>_public.zip and contains:

• <APPID>_public.lua
• key.vdf
• README.txt with short install notes

You can also hit /api/files/<APPID>/zip with curl if you automate installs.

Placement: install SteamTools first if you have not, then copy the .lua and key.vdf into the SteamTools install root (same folder as the executable) and fully restart SteamTools. The /install page has the full step-by-step walkthrough and a troubleshooting section for when a game does not show up.

This generator does not ship classic appmanifest_*.acf files. For depotcache/scripts layouts used with .acf unlocks, see Manifest files.

The website never runs an installer on your PC and never stores game content — only the small text files you download.

How the four steps fit together

┌────────────┐  debounce   ┌────────────┐  proxy       ┌──────────────┐
│ Input box  │ ──────────► │ /api/search│ ───────────► │ Steam store  │
└────────────┘   250ms     └────────────┘              │  search API  │
                                                          └──────────────┘
       │ pick result (AppID + name)
       ▼
┌────────────┐  POST       ┌────────────┐  render      ┌──────────────┐
│ Generate   │ ──────────► │/api/generate│ ───────────► │ .acf + .lua  │
│  button    │             │  (server)  │              │  text/plain  │
└────────────┘             └────────────┘              └──────────────┘
       │ download (user click)
       ▼
   ┌─────────┐    ┌────────────────┐
   │depotcache│   │ SteamTools/    │
   │ /manifest│   │ scripts/lua    │
   └─────────┘    └────────────────┘
       │ restart SteamTools
       ▼
    game unlocked

What runs in the browser

The home page is a server-rendered TanStack Start app. After hydration, the product UI runs:

• The debounced search input.
• The generate / download result card.
• The "Recent" strip that reads from localStorage.

Optional third-party scripts (for example analytics or ads) may load when configured — see the privacy policy. They are not required for search or generate to work.

What runs on the server

• The Nitro server, which serves the routes and bundles the paraglide message modules.
• The two API routes, both in src/routes/api/.
• A 1.5 s per-IP rate limiter on /api/generate and a 300 ms one on /api/search.
• Edge-level request logging for abuse detection. Logs are rotated every 14 days.

The five errors and how to fix each

These are the only errors the generator can return. If you see one, the fix is on the Steam side, not ours.

1. "App not found" (HTTP 404 from /api/generate)

Steam's appdetails endpoint returned success: false. The most common cause is an app that has been delisted from Steam but is still installed on your machine. Steam keeps appdetails reachable for some delisted apps and unreachable for others. There is no workaround at our end — see the manifest-files page for what to do if this is your case.

The second most common cause is a typo in the App ID. App IDs are integers; "Portal 2" is 620, not 620 (trailing space) or 0620 (leading zero). Re-paste without whitespace.

2. "Branch not found"

You typed a branch name that does not exist on the target app. Steam branch names are case-sensitive and must match exactly: public, beta, beta_1, ptb, experimental. If you leave the field blank, you get the public branch.

To discover available branches for a given app, check SteamDB's branches tab — that page is the authoritative source for branch names and the buildid of each.

3. "Rate limit exceeded"

You have made more than one /api/generate request from your IP in the last 1.5 seconds, or more than three /api/search requests in the last 300 ms. Wait a moment and try again. There is no way to "unlock" a rate-limit ban — the limit is automatic, per-IP, and resets on its own.

If you have a legitimate need for higher throughput (a build server, an automation pipeline), use the public API and put your requests behind a backoff loop. Bypassing the rate limit with multiple IPs is grounds for a permanent block.

4. "Steam appdetails timeout"

The Steam appdetails endpoint did not return within 5 s. This happens roughly once every few thousand requests. The generator returns a 503 with a Retry-After: 2 header. Click the Generate button again; the second attempt almost always succeeds because Steam's edge cache has warmed up.

5. "Empty manifest file"

The manifest downloads successfully but is 0 bytes, or it has only the AppState header and no fields. This means the app has no public depots — the app exists in Steam's catalogue but no build has been published. Common for apps still in "Coming soon" status, for apps whose builds are restricted to closed beta, and for some publisher tools.

There is no fix at our end. Once the publisher pushes a public build, the generator will start returning a non-empty manifest for the App ID.

SteamTools.games vs Watt Toolkit vs GreenLuma vs SteamDB

It helps to know which tool does what, because all four are mentioned in the same Steam-unlock conversations.

These tools are not competitors — they cover different layers of the same workflow. SteamTools.games hands off to SteamTools (the desktop client), which is what most people mean when they say "SteamTools".

Performance and limits

• The site is hosted on Cloudflare's edge network. The first request after a cache eviction is a cold start (~600–1200 ms); subsequent requests to the same AppID are warm (~150–300 ms).
• /api/generate is rate-limited at 1 request per 1.5 s per IP. /api/search is 1 per 300 ms per IP. These limits are intentional, not negotiable, and they exist because Steam's appdetails endpoint is also rate-limited upstream.
• The generator does not support apps with more than 100 depots. We have not seen a real app with more than 30. If you find one, file a bug with the App ID.
• The generator does not support app IDs above 2,147,483,647 (the int32 limit). The highest App ID we have ever resolved is in the low 4 million range; Steam itself does not assign higher IDs.

What the service does not do

• It does not modify any game files on your machine.
• It does not bypass Steam's DRM, license checks, or authentication.
• It does not store your search history on a server. The "Recent" strip on the home page reads from your browser's localStorage, not ours.
• It does not require an account, an email, or a phone number.
• It does not bundle or re-distribute any game content. The two files it produces are tiny text files (the manifest is under 4 KB; the Lua is under 1 KB).

If you ever want to confirm the service is doing what it says, the entire server side is in src/routes/api/ and src/server.ts of the open-source project. The client side is in src/blocks/generator.tsx. Every code path is one or two files; nothing is hidden behind a build step you cannot inspect.

Further reading

• Install SteamTools — Windows / macOS / Linux desktop client
• Manifest files explained — what the files contain
• How to find a Steam App ID — when you do not know the App ID
• FAQ — the longer, deeper list of questions
• Troubleshooting generator errors — the blog version of the error table above
• Developers / API — for automation and scripted use

See also

• What is a Steam manifest file, and how do you use it with SteamTools? — the complete front-door guide; this page is a deeper dive into one part of it.