The Steam API Key Scam Explained: How Trade Redirects Work

What is a Steam Web API Key?

Anatomy of the API Scam: Step-by-Step

Phase 1: The Hijack (Getting the Key)

1. You click a malicious link. This could be a fake tournament voting site, a fake skin giveaway, or a typo-squatted trading site.
2. You are prompted to "Sign in through Steam." You enter your username, password, and Steam Guard code.
3. The fake site instantly uses your credentials to log into your account in the background.
4. The Critical Step: The scammer's script doesn't try to trade your items yet. Instead, it quietly navigates to the Steam API registration page and generates an API key for your account. The script records this key and then logs out.

Phase 2: The Ambush (Waiting for a Trade)

1. You request a deposit on the legitimate marketplace.
2. The real marketplace bot sends you a trade offer for your knife.
3. You see the offer on your desktop and everything looks correct.

Phase 3: The Redirect (The Switch)

1. The scammer's script detects the incoming trade offer from the real bot.
2. Using your stolen API key, the script instantly CANCELS the legitimate trade offer.
3. Simultaneously, the script creates a new, identical trade offer from a bot controlled by the scammer.
4. This fake bot is configured to perfectly mimic the real bot: it copies the profile picture, the exact display name, and requests the exact same knife.

Phase 4: The Execution (The Trap)

1. You open your Steam Mobile App to confirm the trade.
2. Because the fake bot perfectly copied the real bot's name and avatar, the trade looks identical to the one you were expecting.
3. If you don't look closely at the fine print, you click "Accept."
4. Your knife is sent to the scammer's clone bot. The real marketplace never receives your item.

How to Detect and Prevent the API Scam

1. The Mobile Authenticator is Your Shield

• Check the Level: Legitimate marketplace bots are often high level. Scammer clone accounts are usually Level 0 or 1.
• Check the Join Date: Your phone will show a warning if the account was created recently or just changed its name. Clone accounts are usually brand new.
• The "Account Creation" Warning: If the Steam app warns you that the account is new or suspicious, CANCEL THE TRADE IMMEDIATELY.

2. Regularly Check Your API Key Page

1. Go to the official API page: https://steamcommunity.com/dev/apikey
2. If the page asks you to register a domain name, you are SAFE. You do not have an active API key.
3. If there is a domain name listed (often a random string of letters) and a long string of characters (the key), you are COMPROMISED.

3. How to Clean a Compromised Account

1. Revoke the Key: On the steamcommunity.com/dev/apikey page, click "Revoke My Steam Web API Key".
2. Deauthorize Devices: Go to Steam Settings -> Security -> "Deauthorize all other devices". This kicks the scammer's script out of your account.
3. Change Your Password: Do this immediately after deauthorizing.
4. Create a New Trade URL: Go to your inventory -> Trade Offers -> Who can send me Trade Offers? -> Create New URL.