How to revoke a Steam API key and secure the account
An unfamiliar API key is a reason to review account security. Removing it can be part of the response, but it does not automatically end every stolen session or undo a fraudulent trade.
Find the official API-key page, revoke an unfamiliar key and understand why checking devices and securing email are also necessary after a compromise.
Use Steam’s own API-key page
Open Steam Community yourself, check that the browser is on steamcommunity.com and visit the official developer API-key page at /dev/apikey while signed in. If a key is registered, inspect the information shown. Revoke a key you do not recognise or no longer need. If no key exists, do not create one just because an external guide or stranger tells you to.
Inventory inspection and ordinary item valuation should not require handing an API key to someone in chat. Do not paste the key into a public screenshot, issue or message. A service’s request for extra account access deserves a clear explanation; convenience alone is not a reason to grant it.
Deal with the wider account-access problem
If you suspect compromise, switch to a trusted device and secure your email first. Change compromised credentials, review authorised devices and remove unfamiliar sessions using Steam’s official security controls. Check your authenticator and recovery options. Review pending trade confirmations and cancel anything you cannot explain.
Revoking a key does not remove malware, invalidate every possible login session or recover already transferred items. Use official Steam Support for account recovery and report suspicious activity with transaction details. Treat messages offering paid recovery or asking for a new ‘safe’ API key as untrusted. After recovery, reinstall only extensions you actually need from their official distribution links.
Frequently asked questions
Does every Steam account have an API key?
No. If the official page shows that no key is registered, there is no reason to create one for this security check.
Is revoking a key enough after phishing?
No. Also secure email, credentials, authorised devices and recovery options, and investigate the device or extension that may have exposed the account.
Set up Steam Guard and protect your recovery access
Enable Steam’s mobile authenticator, keep recovery information safe and understand why security changes can affect trading availability.
Read guide
Steam API scams: how trade impersonation works
A complete analysis of the scheme from the inside: what is really happening, why deleting the key is not enough, and in what order to save the account.
Read guide