The "API key scam" ends with a player confirming a trade that sends their skins to a copy of the account they meant to trade with. Finding a Steam Web API key you never created is the best-known warning sign. But Valve's own explanation is that the key is a symptom: the real problem is that someone already has access to your account.
What a Steam Web API key is
Steam has an API that people and websites can use to request data automatically, or to make changes to the account the key belongs to. Each account can register its own key, and Valve says it should never be shared. If you've given yours away or think someone created one for you, Valve's answer is to revoke it at steamcommunity.com/dev/apikey.
What a user key can do with trades is mostly reading. Valve's documentation for the trading part of the API lists user-key methods that fetch your sent and received trade offers, a single offer, a summary of pending offers, and your trade history. For a scammer, that's a live feed of every offer you send or receive.
Creating a key has become harder. Since early December 2023, Steam asks for a confirmation in the Steam Mobile app before it issues a new key; the developer of an open-source Steam library recorded the change in his release notes at the time. Keys that already existed kept working. So an API key confirmation you didn't ask for is a warning in itself, and an old key you've forgotten about is still worth checking.
How trade redirection plays out
Valve's support article calls this scam trade redirection, and describes it roughly like this:
- The scammer gets into your account first, usually through a phishing login page or malware on your computer.
- They wait for you to start a real trade, with a friend or with a trading site's bot. An API key on your account makes it easy to spot the moment that happens.
- As soon as the real offer exists, they cancel it and create a near-identical one to an account they control, copying the real partner's name and avatar.
- You open the Steam Mobile app, see what looks like the trade you expected, and confirm it. Your items go to the scammer.
Valve stresses that the key isn't required for any of this. It says it's "trivial for a scammer to automate actions on your behalf without API access" once they have your account or computer. Revoking a key without kicking the attacker out leaves the door open.
Pressure is part of the script too. Valve notes that scammers sometimes edit your Steam profile so it looks like you're about to be banned, then push you to move your items to a "safe" account. Steam Support never changes your profile to threaten a ban.
How to check your key
Open steamcommunity.com/dev/apikey while signed in to Steam. If you've never registered a key, the page will offer to create one, and you can close it. If it shows a key and a domain name you don't recognise, revoke it straight away.
Unless you build tools or bots, you're unlikely to need a key. If a website asks you to paste your API key so it can manage your trades, remember Valve's rule that a key should never be shared, and think about what that site would be able to see.
If you find a key you didn't create
Treat it as a compromised account, not just a stray key. Valve's support pages list what to do:
- Sign everyone out. On the Authorized Devices page in your Steam account settings, review the list and use Sign out everywhere if anything looks wrong.
- Change your Steam password from a device you trust.
- Secure your email. Change its password if there's any doubt; Valve notes that hijackers often go after the email account to get into Steam.
- Scan for malware, including browser extensions.
- Revoke the API key if you haven't already, and check that it stays gone.
Then look at what has already happened. If CS2 items left your account in trades during the last seven days, you can reverse those trades from your Trade History under Steam trade protection. The reversal covers every protected trade from that week and puts a 30-day trading and Market cooldown on your account, but it's the only way to get them back: Steam Support doesn't restore items that leave an account. Report any accounts involved using Report Player on their profile.
Habits that stop redirection
Valve's simplest point is also the strongest: if you never confirm an unbalanced trade, there's nothing to redirect. The catch is that selling to a trading site's bot is one-sided by design, since you send items and get paid on the site, so those are the confirmations to check hardest.
Read the whole confirmation screen every time. Valve says the Steam Mobile app shows everything you need to spot a redirected trade, and its trading guidance points to the details in the offer: how long you've been friends, the other account's Steam level and how old it is. A copied name and avatar don't change any of those.
Be suspicious when a trade you just made vanishes and a new one appears in its place, or when a trading site's offer doesn't match what the site showed you. And keep the account clean in the first place: sign in to Steam only on Steam's own pages, which our guide to spotting Steam phishing sites covers in detail.