How to Avoid the API Scam
Protect your skins against the most common Steam scam. Learn how to identify and prevent it.
What is the API Scam?
The API Scam is a fraud where hackers gain access to your Steam 'Web API Key'. They don't steal your account, but they monitor your trades. When you try to send a skin to someone (like a sales bot), they instantly cancel the real trade and create a fake copy with an identical profile, so you hand your skins to the scammer thinking it's the bot.
How the Scam Works
1Silent Access
You log in to a phishing (fake) site with your Steam. They steal your API Key (not your password).
2Monitoring
Their script monitors your trades 24/7. If you don't trade anything, nothing happens.
3The Attack
When you sell a skin and send the trade to the CubeSKINs bot, the script detects it, cancels the legitimate trade, and creates an IDENTICAL one coming from a fake account with the same name and photo as our bot.
4The Mistake
You accept the trade on mobile without checking the account creation date. The skin goes to the scammer.
How to Protect Yourself Now
Check and Revoke your API Key
Access the Steam API page. If there is ANY key generated there that you didn't create (usually named 'localhost' or random), REVOKE IMMEDIATELY. Normal users do not need to have an API key generated.
Check my API Key
Generate a new Trade URL
After revoking the key, change your Trade URL. This invalidates any old link the scammers might have saved.
Support
Still have questions?
Our team is available to help you with any problem.
Talk to Support