The Steam API Key Scam: How Skins Get Stolen (and How to Stop It)
2026-10-01 · 5 min read · CS2
If you trade or gamble CS2 or Rust skins, the Steam API key scam is the biggest threat to your inventory. It's how most "my skins vanished" stories happen.
How the scam works
1. You log in to a fake site that copies a real gambling or trading site. Often it's a fake "Sign in through Steam" pop-up window. 2. The scammer now has access to your account, quietly creates a Steam Web API key, and waits. 3. When you make a real trade, they cancel it instantly and send a near-identical offer from a fake account that copies your trade partner's name and picture. 4. You confirm it in the Steam app, and your skin goes to the scammer.
Check your account right now
1. Go to steamcommunity.com/dev/apikey while logged in. 2. If a key exists that you didn't create, click Revoke. 3. Change your Steam password and deauthorize all other devices (Steam settings). 4. Make sure the Steam Guard mobile authenticator is on.
Habits that keep you safe
- Type gambling site addresses yourself, or use bookmarks. Don't click links from DMs, Discord or YouTube comments. - A real "Sign in through Steam" page has the steamcommunity.com address in a real browser window you can drag outside the page. - Before confirming any trade in the app, check the partner's account age and level, not just the name and picture. - Never share your API key, even with "support".
See our full guide to spotting a scam gambling site and our CS2 rankings.
