Steam API Key Scams Explained

What is a Steam API key scam?

A Steam API key scam is a way of stealing your skins at the exact moment you try to trade them. You send a trade offer to a marketplace bot or a friend. A script watching your account through a Steam Web API key cancels that offer and creates a new one that looks identical, but goes to an account the scammer controls. You open your phone, see a trade that looks right, confirm it, and the items are gone.

Valve calls this a trade redirection scam and explains it on its Scam: Trade Redirection page. That page also has a section called "The Steam API and its role in this scam", which is where the name comes from. Valve's summary of the key itself is one line: "An account's API key - the unique key that identifies that account in the API system and allows its access - should never be shared."

The scam works because the fake offer is not a hack of Steam. It is a real trade offer, created with real access to your account, that you approve yourself. That is why the fix is about habits, not software.

What is a Steam Web API key actually for?

The Steam Web API is a tool for developers. Valve's trade redirection page describes it as something "users and websites can use to automate requests for data from Steam, or execute changes to the account hosting a specific API key."

A key is tied to one account. Anyone who holds it can do a few things on that account's behalf, including reading its trade offers and cancelling or declining them. That is exactly the power a redirection scam needs.

Most players have no reason to ever create one. The key is not needed to:

• Log in to a marketplace. Sites use Steam's own login page for that.
• Receive trade offers. Sites use your trade URL, which only lets them send you offers, not read or cancel them.
• Sell, buy, or inspect skins.

If a site tells you it needs your API key to "verify your inventory", "enable instant trades", or "confirm your account", that is the scam. There is no honest version of that request. Our checklist for judging sites is in how to spot scam trading sites.

How does the API key scam work step by step?

It has two halves. The first half gets the key. The second half uses it.

Getting the key. There are three common ways.

1. You give it to them. A site or "trading helper" walks you through creating a key at steamcommunity.com/dev/apikey and pasting it in.
2. They log in as you and create one. After you type your password and Steam Guard code into a fake Steam login page, the scammer logs in, creates a key, and logs out. Nothing looks different to you.
3. Malware on your computer does it. Valve's Account Security Recommendations warn that Steam-targeting malware often hides in cheats, cracked software and "inventory managers", and may wait quietly until your account is worth robbing.

Using the key. Then the scammer waits, sometimes for weeks.

1. You send a trade offer, say to a marketplace bot to sell a knife.
2. The script sees the offer through the API and cancels it in under a second.
3. It sends you a new offer from an account with the same name and avatar as the bot, containing the same items.
4. Your phone buzzes with a confirmation. It looks like the trade you just made. You confirm.
5. The knife goes to the scammer's account. The marketplace never received anything and shows your sale as pending or cancelled.

Valve is careful to note that the key is "not a necessary component" of this scam. If a scammer has your password or your computer, they can do the same without it. But in practice the key is what lets them do it fast and quietly, without staying logged in.

How do you check if your account has an API key?

Two minutes. Do it now, before you read the rest.

1. Log in to Steam in a browser and go to steamcommunity.com/dev/apikey.
2. If the page shows a form asking for a domain name, you have no key. Good.
3. If the page shows a key (a long string of letters and numbers) and a domain, a key exists.

Ask yourself if you created it. If you did, for a real reason you understand, fine. If you did not, or you created it because a site told you to, someone else may be holding a copy. Go to the next section.

The domain name shown next to the key is a hint, not proof. Scammers often enter something bland like "localhost" or the name of a real site.

How do you revoke a Steam API key?

On the same page, click the button to revoke the key and confirm. That key stops working at once.

Revoking is safe. Nothing on your account depends on it unless you set something up yourself. If you did, that thing will stop working and you can create a fresh key later, after your account is clean.

Revoking alone is not enough if you were hijacked. The scammer still has whatever got them the key in the first place: your password, your email, or a foothold on your computer. They can just make a new key. So revoking is step one of the recovery list below, not the whole list.

What are the signs you have been API scammed?

Some signs show up before you lose anything. Watch for them.

The trade hold calculator can help with the second row: if the marketplace says your item is still locked or unlocks later than you thought, check where it actually went.

What do you do after an API scam?

Follow this order. Skipping ahead lets the scammer do it again.

1. Secure the account first. Change your Steam password from a device you trust. Go to your account's authorized devices and sign out everywhere. Check that the email and phone number on the account are still yours. If anything changed, recover the account through Steam Support before doing anything else.
2. Secure the email. If your Steam email was also compromised, the scammer can reset your Steam password again. Change that password too.
3. Revoke the API key at steamcommunity.com/dev/apikey.
4. Scan for malware. If the key came from something running on your computer, steps 1 through 3 are undone the moment you log back in.
5. Check Trade History for trades you did not make.
6. Reverse trades if you can. Since 16 July 2025, all CS2 items received in trades are Trade Protected for 7 days and the sender can reverse all such trades from the Trade History page, per Valve's Trade Protected Items FAQ. It reverses every trade from the window, not just the scam, and your account gets a 30-day trade and market cooldown. For a stolen knife, that is worth it. Details in trade protection and reversals explained.
7. Report the scammer's account through its Steam profile with "Report Player". Include the lookalike account and any Steam accounts that sent you links.

If the trade is older than 7 days, or the items were from another game, there is no reversal. Valve's Item Restoration Policy says Support does not restore items that left an account for any reason. That is hard to read after a loss, but it is the rule, and anyone who promises to get your items back for a fee is running a second scam.

How do you stop it from happening again?

The scam needs two things: access to your account, and a confirmation you did not read. Take away either one and it fails.

Take away the access.

• Never create an API key unless you are building something and know what it does.
• Never type your Steam password or Steam Guard code anywhere except Steam's own domains. Valve's security page lists them: steampowered.com, store.steampowered.com, steamcommunity.com, help.steampowered.com.
• Do not install cheats, cracked games, or "inventory tools" from links people send you.
• Check steamcommunity.com/dev/apikey now and then. It takes ten seconds.
• Run any new site through the scam link checker before logging in.

Take away the blind confirmation.

• Read every trade confirmation on your phone. Valve's trade redirection page says the confirmation window gives you "all the information you need to understand if a trade has been redirected."
• Check the receiving account's details, not just its name and picture. Names and avatars are copied. Account age, Steam level and friend duration are not.
• If an offer you sent gets cancelled and a new one appears, decline the new one and investigate.
• Never rush. A marketplace bot does not care if you take a minute.

The full account hardening checklist, including the authenticator setup and email security, is in how to secure your Steam account. An API key scam is a symptom. A secure account and a slow thumb on the confirm button are the cure.