"No manifest request code was returned" — now what?

01The error, word for word

You ran a download, the login worked, the depot key arrived — and then this, with your own IDs in place of these:

Those three lines are one event, not three problems. DepotDownloader asked Steam for a manifest request code, Steam answered with nothing (result: 0 is Steam's way of saying no), and without a code the CDN returns 401 to the actual download. The 401 is downstream noise — the decision was made at the first line.

02What's actually happening

Since May 2022, every single manifest download needs a short-lived token that Steam's servers issue — or don't — based on your account, the app, and whether that manifest is still considered "current" by any branch. The full mechanics live in the manifests deep dive; the one-sentence version is that the gate is server-side, evaluated before a single byte of game data moves. That has a hard consequence worth internalizing before you spend an evening on it: if Steam has decided not to issue a code, no flag, retry loop, fork or VPN changes the answer. What can change the answer is asking as a different identity or for a different manifest — which is exactly what the checklist below walks through.

03The diagnostic tree — in this order

1. Were you anonymous? Log in. This is the highest-yield fix on the page. Anonymous accounts get a deliberately trimmed view of manifest history, and plenty of manifests that refuse an anonymous request will issue a code to an account that owns the game. Even some dedicated server depots — traditionally the anonymous-friendly zone — have gone stricter on older manifests (issue #586 is a Rust server build doing exactly this). Same command, plus credentials:

2. Is the manifest still on a branch? Use the branch, not the ID. Open the app on SteamDB → Depots → your depot → Manifests, and check whether the build you want is referenced by any living branch — a legacy beta, a versioned rollback branch, anything. Manifests reachable through an active branch still get codes reliably, including password-protected ones. If you find one, swap the raw -manifest for -branch name (plus -betapassword if it's protected) and you're done — this is the most dependable downgrade path in 2026, and the downgrade guide covers it end to end.

3. Is it just old? Then it's gated, and that's the whole story. If the manifest is months or years behind the current build and hangs off no branch, you've hit the January 2025 lockdown — Valve simply stopped issuing codes for deep history on most games. The live status page tracks exactly what's still passing and what isn't. I won't sugarcoat it: for this branch of the tree there is no fix, only the advice to archive what still works today.

4. Triple-check your three IDs. Less common, more embarrassing (I've done it). A manifest ID belongs to one specific depot. Grab the manifest from the Windows depot and pair it with the Linux depot's ID — refusal. Copy a build ID from SteamDB instead of a manifest ID — refusal. The -app / -depot / -manifest triple has to be internally consistent, all from the same SteamDB depot page row.

5. Recent manifest, owned game, correct IDs, still failing? Wait it out. Transient refusals exist — Steam hiccups, and codes get re-requested as they expire (DepotDownloader caches each one for about five minutes, matching their lifetime). Sanity-check by downloading the latest manifest of the same depot: if that works, your tooling and account are fine and the specific manifest is gated; if even latest fails, retry in an hour before suspecting anything deeper.

04The per-account lottery

Here's the part that makes people doubt their sanity: the same manifest, the same day, can issue a code to one account and refuse another. Discussion #573 — the de-facto community log for this whole saga — has a clean example: one user gets 401 on GTA IV 1.0.7.0 while a friend pulls the identical manifest without trouble. Nobody outside Valve has fully mapped why; purchase date, region and license type are the usual suspects. The practical takeaway is unglamorous but real: if a friend's account gets the code, the build is still obtainable — have whoever can download it archive it now, because per-account quirks have a habit of converging toward "no" over time.

05What won't work (save yourself the evening)

• Retrying in a loop. The refusal is a policy decision, not a flaky endpoint. Once you've ruled out the transient case above, attempt #50 returns what attempt #2 did.
• Switching tools. SteamCMD's download_depot answers to broadly the same rules. Worth two minutes as a cross-check — I've seen the two disagree — but it's plan B, not a bypass.
• "Request code bypassers" and manifest dumpers. Anything claiming to defeat the gate is replaying leaked codes (dead within minutes), routing you through shared accounts (ToS violation, your account at stake), or is malware aimed at precisely the frustrated audience reading this page. The gate lives on Valve's servers; there is no client-side key. More on the trust angle in Safety.
• VPNs and region tricks. The code is tied to your account's entitlements, not your IP.

06Reporting it properly

If you've walked the tree and believe you've found something genuinely broken — or a manifest that should be gated but isn't, which is just as interesting — report it where it'll be seen. Post in discussion #573 or the issue tracker with three things: the exact command (credentials redacted), the complete output from login to abort, and whether the latest manifest of the same depot works for you. That last line is what separates "Valve gated it" from "something is actually wrong" — and saves the first round-trip with whoever triages it.

And if what you've found is a policy change — old manifests suddenly working again, or a fresh wave of refusals — the status page is where I track that; the reporting routes at the bottom of it reach me fastest.