An API key scam starts with a phishing page. You type your Steam login and Steam Guard code into a fake site, often one that promises a free skin, a vote for a team or a trade check. With that login the scammer can register a Steam Web API key on your account, or simply keep quiet access to it. Nothing looks different. You can still log in, and your items are still there.
The trap springs later, when you send a real trade offer to a friend, a marketplace bot or a buyer. Steam Support calls this a trade redirection scam: the scammer, who already controls your account, cancels your offer and sends a new one with the same items to a lookalike account they own, hoping you confirm on your phone without reading it. Steam notes that an API key makes this easier but is not even needed once someone has your login. You confirm, thinking it is the offer you just made, and the items go to the scammer.
How do I know if I am a victim of an API key scam?
The clearest sign is two trade offers in a row for the same items, where the first is cancelled and you did not cancel it. Another sign is a confirmation on your phone for an offer to an account that is not on your friends list, or whose Steam level does not match the real trader. Finally, a key you did not create on steamcommunity.com/dev/apikey confirms it.
How do I remove an API key scam from my account?
Revoke the key on the Steam Web API key page, change your Steam password, check your authorized devices and use the sign out everywhere option, as Steam's account security recommendations advise. Scan your computer for malware and check that your Mobile Authenticator is still yours. Then look at your trade history. If items left your account in the last 7 days, you can reverse those trades yourself from the Trade History page under Trade Protection. Reversing puts a 30-day trade and Market restriction on your account, and Steam Support cannot lift it.
To avoid the scam, never log in through a link someone sent you, and read the recipient name on every phone confirmation. Marketplace bots show their exact account name on the site, so compare it before you confirm. Paste any link you are unsure about into the scam link checker before you click.