Steam · Independent guide
Steam API Key Scam: Check Your Key, Revoke It, Then Lock the Account Down
Steam calls this Trade Redirection; many players call it the API key scam. Someone who already got into your account cancels your real trade and sends a copy to a lookalike profile, hoping you confirm on your phone without looking. Revoking the key is step one, not the whole fix.
Check the warning signsNever paste your API key, password or Steam Guard code anywhere, including here; we never ask for them.
Concept illustration, not a screenshot of the recovery process.
On this page
Steam's own steps
Each action links to Steam Support pages or your own account settings.
Your key stays yours
We never ask for API keys, passwords, Steam Guard codes or recovery codes.
Independent guide
Respawnr is not affiliated with Valve or Steam and does not act on accounts.
Signs a Web API key is being used against your trades
Check these on your own account; one of them is enough to start the lock-down.
A key you never created
Most players never need a Steam Web API key. If a key and a domain name you don't recognize are registered on your account, treat the account as compromised.
Where to look
Signed in at steamcommunity.com/dev/apikey, the Steam Web API key page for your account.
Trade offers that cancel and reappear
An offer you sent or received is cancelled within seconds, then a near-identical one shows up from or to a different profile.
Where to look
Your trade offers and Trade History on the Steam Community, reached from your own profile.
A lookalike trade partner
Same name and avatar as the person you were dealing with, but a different profile address, Steam level or account age.
Where to look
Open the partner's profile from the trade offer and compare its address with the one you trusted.
Confirmations you didn't expect
A trade, Market listing or, some players report, an API key request waiting for approval that you never started.
Where to look
The trade confirmations screen in the Steam Mobile app; labels and layout can change between app versions.
A profile edited to look like a ban
Your profile text or name suddenly threatens a ban or points to an "admin" account. Steam says Support never edits profiles to threaten a ban.
Where to look
View your own Steam Community profile as others see it and check the summary and name history.
These checks are for the Steam account you own and sign in to yourself. Never request, use or share an API key for anyone else's account.
Revoke the key and close the door behind it in 5 steps
Steam says the key is not a necessary part of this scam, so do every step.
You need to be able to sign in to your own account. If the password or email was already changed and you can't sign in, use Steam's "Help, I can't sign in" and the hacked-account guide instead. Also secure the email linked to Steam. Menu labels change over time; follow what your current account pages show.
-
Open the API key page
On steamcommunity.com/dev/apikey, see whether a key and domain you don't recognize are listed.
-
Revoke the key
If a key is there that you didn't create, revoke it on that same page.
-
Clear pending trades and confirmations
Cancel sent or received trade offers and decline any Mobile app confirmation you didn't start.
-
Cut off access
Use Sign out everywhere on Authorized Devices, then set a new Steam password.
-
Scan for what automated the swap
Scan for malware and remove untrusted mod or inventory managers and extensions; Steam says a compromised PC needs no key.
What scammers say vs. how Steam actually works
These lines lead straight to a redirected trade or a registered key.
Warning sign
"My trade offer glitched, so I sent a new one. Just confirm it on your phone."
In Trade Redirection, Steam says, the scammer cancels your real offer and sends it to a lookalike account instead. Check the partner on the confirmation screen.
Warning sign
"Paste your API key so our site can check your inventory."
Steam says an account's API key should never be shared; it lets others act on your trades.
Warning sign
"Register an API key and send it to us so our bot can accept your trade instantly."
A key on your account lets whoever holds it watch and act on your trades; Steam says it should never be shared.
Warning sign
"Install this trade tool to speed up confirmations."
Steam warns that malware aimed at Steam accounts can pose as mod and inventory managers, and with your PC compromised no API key is even needed.
Warning sign
"Hurry and confirm, the offer expires in a minute."
The scam counts on you confirming on your phone without reviewing; Steam says to check every detail first and never confirm an unbalanced trade.
What to do instead
- Before you tap confirm, read every detail the Steam Mobile app's confirmation screen shows about the partner and the items; Steam says it is enough to spot a redirect.
- If a site or trader asks you to create or share an API key, stop, and check steamcommunity.com/dev/apikey afterwards.
- Report the lookalike profile with Report Player on that profile, and report off-Steam contacts on their own platforms.
- Talk to Steam about your account only through help.steampowered.com, never through a chat contact.
A few details worth knowing
What is the Steam API key scam?
Steam calls it Trade Redirection. Someone who already has access to your account watches your trades, cancels a real one and sends a copy to an account made to look like your trade partner, hoping you confirm without checking.
Is revoking my Steam API key enough?
No. Steam says the key is not a necessary part of the scam, because someone with access to your account or computer can automate trades without it. Also change your password, sign out all devices, scan your PC and secure your email.
Where do I check if my account has an API key?
Sign in and open steamcommunity.com/dev/apikey. If a key is listed that you didn't create, revoke it on that page and follow the lock-down steps above.
Can Steam return items I already confirmed in a redirected trade?
Steam's stated policy is that it does not restore items that left an account through trades. The one owner-side exception, reversing Trade Protected Counter-Strike 2 trades within 7 days, is covered in the stolen-items guide.
Should I ever share my API key with a trading or skins site?
No. Steam says an account's API key should never be shared, and a site that asks for it can use it to watch and interfere with your trades.
Go a little deeper
- How to Read a Steam Trade Offer Before You Confirm
Check the partner's real profile, every item on both sides, hold notices and the phone confirmation before you accept a Steam trade offer.
Official guidance
Check the platform’s current instructions and the options shown for your own account.