Steam API Revoke Method

A Steam API key lets third-party sites and tools read account data and act on your behalf in limited ways. Scammers trick players into creating or sharing a key through fake trade offers, fake giveaways and phishing pages, then use it to watch trades and redirect items. If your key was ever shared, pasted into a suspicious site or created by someone else, revoke it right away rather than waiting to see if anything happens.

Sign in to your Steam account on the official Steam site, then open the API key management page from your account settings. If a key exists, use the revoke option to remove it, and confirm the change when asked. After revoking, no site can keep using the old key, and you can create a fresh one later only if a trusted tool genuinely needs it. If you cannot reach the page, contact Steam Support from your account and explain that the key may be compromised.

After revoking, review the apps and sites authorised on your account and remove anything you do not recognise. Check your recent trade offers and trade history for offers you did not make, and look at recent login activity for sessions from places you do not recognise. Change your password if anything looks off, and treat any trade offer that appeared while the key was exposed as suspect. The Steam API key scam check and the avoid Steam API key scam guide explain the common tricks in more detail.

Turn on Steam Guard with the mobile authenticator if it is not already on, and use a unique password you do not reuse anywhere else. Never share your API key, login codes or password with anyone, including people who claim to be traders, moderators or support staff. If you trade skins or accounts, use escrow and read the Steam trade hold guide so you know how holds protect you.