How to Sync Your CS2 Inventory Without a Steam API Key
You do not need a Steam Web API key to display or sync your CS2 inventory. Sharing one is risky: it can let an attacker watch and redirect your trades. Instead, sign in with Steam OpenID, which only confirms your SteamID, and let an open-source browser extension read your inventory from your own signed-in Steam session.
Why is sharing a Steam Web API key risky?
A Steam Web API key is a credential tied to your account. It lets software read your account data and, crucially, watch and cancel your trade offers on your behalf. Legitimate platforms have valid reasons to use the API, but the key itself was never meant to be handed to a stranger or pasted into a random site.
Steam Support documents the resulting scam as trade redirection. After phishing your login, an attacker generates an API key on your account, then watches your outgoing trade offers. When you send skins to a friend or a marketplace, the malicious automation cancels the real offer and slips in a look-alike one pointing at the scammer bot. You confirm what looks like the correct trade in Steam Guard, and the items leave your inventory.
The dangerous part is that the attacker often does not need lasting control of your account. Short access to create a key can be enough to set up the substitution and wait. This is why the safest posture is simple: never enter or share your API key on a third-party site, and revoke any key you did not create yourself.
Can you show a CS2 inventory without an API key?
Yes, and it helps to separate two things people conflate: signing in, and reading inventory data. Signing in through Steam uses OpenID, a flow hosted by Steam itself that only proves you own a given SteamID. It never asks for your password on the third-party site, never asks for an API key, and never grants any trade permission.
Reading the inventory is the other half. VSkin pairs that sign-in with a browser extension that reads your inventory from your own signed-in Steam session, the same data your browser already sees when you open your inventory page on Steam. Because it comes from your session rather than a shared key, there is no API key to leak, intercept, or abuse. It is also what makes trade-locked skins visible to other people, since your own session is the only place they appear.
What does the extension read, and what does it not do?
Syncing your CS2 inventory is the only thing it does. It reads the inventory from your active Steam session and sends that item data to VSkin so your showcase reflects what you actually own. It is open-source, so anyone can audit exactly what it reads before installing it.
It does not ask for or use a Steam Web API key, does not request any trade permission, and never initiates, signs, cancels, or redirects trades. It does not run on other websites. Trades themselves stay peer-to-peer between players: VSkin never holds your items, wallet, or trades.
Display and sync your CS2 inventory without a Steam API key
- 1
Sign in with Steam
Open vskin.gg and sign in with Steam. The Steam OpenID flow only confirms your SteamID. You never type your password on VSkin and you are never asked for a Steam Web API key or any trade permission.
- 2
Install the open-source extension
Add the VSkin browser extension from the Chrome Web Store; it runs in Chrome and other compatible browsers. Because it is open-source, you can review exactly what it reads before installing.
- 3
Stay signed in to Steam in your browser
Make sure you are signed in to Steam in the same browser. The extension reads the same inventory data your browser already sees on your Steam inventory page, including items that are currently trade-locked.
- 4
Keep your API keys private
As a habit, never enter a Steam Web API key on any third-party site. Periodically open Steam's API key page and revoke any key you do not recognise. VSkin never needs one.
Frequently asked questions
Does VSkin ever ask for my Steam API key?
No. VSkin signs you in with Steam OpenID, which only confirms your SteamID, and reads your inventory through an open-source extension from your own signed-in Steam session. There is no Steam Web API key to generate, paste, or share, and no trade permission is ever requested at any point.
Why is giving out a Steam Web API key dangerous?
A leaked API key lets an attacker watch your outgoing trade offers and substitute them with look-alike ones pointing at their own bot, so you confirm a trade that sends skins to a scammer. The key is tied to your account, so never enter it on third-party sites and revoke any key you did not create yourself.
Can I view someone's CS2 showcase without installing anything?
Yes. Viewing a public showcase on vskin.gg requires nothing installed, no API key, and no Steam sign-in just to look. Only the owner uses the open-source extension to publish and sync their own inventory.
How can a showcase display trade-locked skins that Steam hides?
Steam shows trade-protected items only to the account that owns them. Reading from that account's own signed-in Steam session is what lets a showcase publish them for other people to see, without any trade access or API key. It only works for owners who sync their own showcase with the extension.
Does the extension run in the background or touch my trades?
No. Syncing your inventory is the only thing it does, and it does not run on other websites. It never initiates, signs, cancels, or redirects trades, and VSkin never holds your items or wallet.
Show your own CS2 inventory on VSkin
Sync your inventory with the VSkin extension to publish a public showcase, trade-locked skins included, and share one link with the traders you deal with.
Publish your showcase→