You request a withdrawal on a skin site. A trade offer arrives. A few seconds later it's canceled, and a fresh offer appears from what looks like the same bot: same name, same avatar, same item. You confirm it on your phone. The skin is gone, and it didn't go to the site.
That's the Steam API key scam, and it's been the most common way CS2 players lose skins for years. Nothing about it is especially clever. Nobody cracked your password with a supercomputer. You approved the trade yourself, because everything about it was set up to look normal. The good news: checking whether your account is exposed takes under a minute, and locking it down takes about ten.
What a Steam Web API key actually is
The Steam Web API is how websites and tools talk to Steam automatically. Developers use it to read inventories, look up profiles and track trades. Any Steam account can register a key at steamcommunity.com/dev/apikey, and the key acts on behalf of the account that created it.
For a trader, the part that matters is trade offers. Someone holding your key can see your incoming and outgoing offers in real time, and can cancel or decline them. They can't send offers from your account with the key alone, and they can't confirm anything on your phone. They don't need to. They only need to know when you're about to trade and to get rid of the real offer at the right moment.
Some legitimate P2P sites and marketplaces ask for a key so they can track trades automatically. That's a real use, but it's also exactly the access the scam exploits, so think hard before handing one over and only ever do it for a site you know well.
How the scam works, step by step
- The bait. You get sent to a page that wants you to sign in with Steam. Common lures: a Discord message asking you to vote for someone's team, a "free case" site, a fake tournament, a skin price checker, or a friend's account (already hijacked) saying "is this you in this screenshot?"
- The fake login. A Steam sign-in window appears. It has the Steam logo, the right colors, even an address bar showing steamcommunity.com. Often it isn't a window at all, just part of the web page drawn to look like one.
- The relay. You type your username, password and Steam Guard code. The scam page passes them to the real Steam in real time and logs in as you. To you it looks like a normal login. The bait site might even work afterwards.
- The key. Using your session, the scammer registers a Web API key on your account. Then they leave everything else alone so nothing looks wrong.
- The wait. Their software watches your trade offers, sometimes for weeks.
- The swap. The moment a real offer appears (a site withdrawal, a P2P sale, a trade with a friend), they cancel it through the API and immediately send you a near-copy from their own account, with the same name, avatar and items, set up so your skins go to them or theirs never arrive.
- The confirmation. You see an offer that looks right, open the app, and confirm. That's the step that moves the items, and you're the one who did it.
The reason it works so well on gambling and trading sites is that canceled offers are normal there. P2P sellers time out, bots resend, offers expire. One more cancellation doesn't feel like a warning.
Why Steam Guard didn't stop it
People who get hit are often surprised, because they had the mobile authenticator switched on. It did its job. It just wasn't built for this. The authenticator protects two moments: signing in and confirming trades. In this scam, you hand over the sign-in code yourself on the fake page, and you confirm the bad trade yourself in the app. The scammer never has to beat the authenticator, because they route around it through you. That's also why the fix is partly technical (revoke the key, sign out other devices) and partly habit: reading what you confirm.
Check your account right now
What you'll see on that page:
- A registration form asking for a domain name: you have no key. That's the normal state for most players.
- A key with a domain you registered yourself, for a tool or site you knowingly use: fine, but ask whether you still need it. If not, revoke it.
- A key you don't remember creating: someone else made it. Domains used by scammers are often random strings, generic words, or something made to look official.
While you're checking, look at two more things. Your Steam Guard settings list the devices that are signed in to your account, and your trade history shows every completed trade. Anything you don't recognize in either one is a reason to work through the lockdown steps, even if the key page is clean.
How to lock your account down
Do these in order, from a device you trust. If you suspect malware on your PC, use your phone or a different computer.
- Revoke the API key. On the dev/apikey page, click Revoke. This stops the monitoring immediately.
- Sign out every other device. In the Steam mobile app or your account's Steam Guard settings, use the option to deauthorize or sign out all other devices. This kills the scammer's logged-in session, which they could otherwise use to register a new key.
- Change your Steam password. Make it long and unique. If you reused it anywhere else, change it there too.
- Secure your email. Change the password on the email account tied to Steam and switch on two-factor login there. Whoever controls your email can often recover your Steam account.
- Check the authenticator is still yours. Open the Steam app and confirm Steam Guard is active on your phone. Make sure you still have your revocation code stored safely offline.
- Clean up your browser. Remove any extension you don't recognize or don't use, especially "float checkers", "price helpers" and trading tools from unknown developers. Malicious extensions can steal Steam sessions without a fake login ever happening.
- Check the key page again tomorrow. If a new key has appeared, something still has access, most likely malware or an extension. Deal with that before trading anything.
If items have already been taken, act quickly. Since Valve introduced Trade Protection in mid-2025, items in a trade are protected for 7 days, and Steam offers a way to reverse trades during that window from your trade history. It's designed for exactly this case, a compromised account, and it isn't surgical: it undoes your recent trades as a group and puts restrictions on your account afterwards. Read Steam's explanation before using it, and contact Steam Support if anything is unclear. Don't wait days to decide.
How to tell a fake Steam login
The fake login window is where almost every case starts, so it's worth learning the tells. Most fakes use a technique sometimes called browser-in-the-browser: a picture of a login window drawn inside the page you're already on.
| Check | Real Steam sign-in | Fake window |
|---|---|---|
| Drag it outside the browser | A real pop-up window moves freely across your screen | It's stuck inside the page and can't leave the browser |
| Address bar | Real browser bar showing steamcommunity.com with a valid lock | An image of an address bar, you can't click into it or edit it |
| Password manager | Offers to fill your saved Steam login | Stays silent, because the domain doesn't match |
| Already signed in | Usually shows your account and a single "Sign in" button | Asks for your full username, password and code every time |
| QR code sign-in | Works with the Steam mobile app | Often missing, or the code doesn't respond |
The password manager test is the one we lean on most. If your password manager won't autofill on a "Steam" login, something is wrong with the domain, and you should close the page without typing anything.
Better still, sign in to Steam on sites only through flows you started yourself, from a site you reached by typing its address or using your own bookmark. When the Steam app offers QR code sign-in, use it. It means your password never touches the page.
The lures we see most in 2026
The technique hasn't changed much in years. The stories wrapped around it change all the time. Recent ones:
- "Vote for my team." A friend, or someone claiming to be one, asks you to vote in a small tournament. The voting site needs a Steam login.
- "You've been reported." Someone claims your account was reported for scamming and you need to "verify" with an admin or Steam employee, who then sends you a login link. Steam staff don't contact players through friend requests or Discord.
- Free cases and giveaways. A site offering free skins for signing in, often promoted by hijacked accounts posting in community groups or game chat.
- The helpful trader. A buyer offers more than market price for your item but insists on using a particular "middleman" site.
- Price checkers and inventory tools. "See what your inventory is worth" pages that need a Steam login and ask for nothing else.
- Fake versions of real sites. Copies of popular gambling and trading sites on look-alike domains, usually reached through ads or search results.
Habits that make the scam fail
Even if a scammer does get a key on your account, they still need you to confirm the swapped offer. That gives you a last line of defense, if you use it.
- Treat "canceled, then re-sent" as a red flag. When an offer vanishes and an almost identical one appears seconds later, stop and check your key page before confirming anything.
- Check the partner's profile, not their name. Names and avatars are copied perfectly. Steam level, account age and profile history are much harder to fake. Compare them with the bot or seller details the site shows on its withdrawal page.
- Read the confirmation screen properly. The Steam app shows who you're trading with and what's moving. Most victims tap "confirm" from habit.
- Bookmark the sites you use. Typing site names into a search engine is how people end up on copies.
- Look at the key page once a month. It takes ten seconds. Set a reminder if you trade a lot.
- Use the authenticator. It doesn't stop this particular scam on its own, because you're the one confirming, but it blocks a long list of others. Our Steam trade URL guide covers the setup and how trade holds work.
How this connects to gambling sites
Skin gambling and trading sites are the main hunting ground for this scam, because they generate a steady stream of trade offers worth hijacking. That doesn't make the sites themselves the problem, but it does mean that how a site handles trades matters.
Sites that show clear bot or seller details on their withdrawal pages make swaps easier to spot. P2P sites where the trade happens between two users add another variable, since you're checking a stranger's profile rather than a known bot. Our explainer on P2P vs bot skin deposits covers what to check in each case. Withdrawing in crypto instead of skins sidesteps the Steam side of it completely, which is one reason we like sites such as CSGOEmpire and Clash.gg that support both. Security and payout handling feed into our trust score, and how we rate sites explains the weighting.
One more thing. Sites will never ask you to create an API key through a chat message, a Discord DM or a support ticket. If "support" asks you to register or share a key, end the conversation.
A two-minute monthly security check
- Open steamcommunity.com/dev/apikey. No key, or only one you knowingly use? Good.
- Look at the devices signed in to your account. Remove anything unfamiliar.
- Skim your trade history for anything you don't recognize.
- Check your browser extensions and remove what you don't use.
- Confirm your revocation code is still stored somewhere safe and offline.
Five steps, two minutes, and the most common way CS2 players lose their skins stops working on you. If you gamble on these sites, keep that to money you can afford to lose. They're 18+ only, and our responsible gambling page has support and blocking tools if you need them.
