The Steam API key scam: how to check and what to do
This is one of the most damaging Steam trading scams, and the check takes under a minute.
How it works
A scammer phishes your login through a fake site, signs in as you, and registers a Steam Web API key on your account. The key lets them monitor and interfere with your trade offers automatically. In a common version they cancel your genuine offer and substitute a near-identical one from another account.
How to check your account
Open steamcommunity.com/dev/apikey while signed in. If the page shows a key that you did not create, treat your account as compromised. If you have never registered a key, you should see the registration form with no key listed.
What to do if you find one
Act in this order.
- Revoke the key from that page.
- Change your Steam password from a device you trust.
- Review and remove unknown Steam Guard devices.
- Cancel any pending trade offers you did not create.
- Report the phishing site and the account that led you to it.
How to avoid it
Never sign in through a link someone sends you, check the address bar every time, and use Steam Guard Mobile Authenticator confirmations. Read the details of each confirmation before approving.
Check a Steam trader now
Paste any profile, SteamID or vanity name. Free, no signup.