Steam restricts inventory visibility
Valve’s release notes introduce ten days of invisibility for purchased and traded Counter-Strike items when other users inspect an inventory.
STEAM ACCESS
Their credentials.
Their infrastructure.
The external service still needs the system Valve controls.
User API keys, publisher keys and Steam session JWTs serve different purposes. This file follows the documented credential paths, the infrastructure beneath them and the dated Link Filter responses. Version-pinned code audits remain attached as separate evidence files.
FOLLOW THE ACCESS RECORD
- 01 / ISSUEA Steam credential.
Account identity, issuer-defined context and expiry.
- 02 / USEA service receives access.
Documented collection and renewal paths, pinned to their versions.
- 03 / ENFORCEA route can be examined.
Saved requests, filter responses and the operator’s declared host.
01Three credentials in
TOKENS & PERMISSIONS
Three credentials in
the trading system
THREE CREDENTIALS / THREE ACCOUNT CONTEXTS
User key. Publisher key. Session JWT.
Compare who receives each credential, what it accesses and how it enters the skin-trading system.
Three columns · swipe horizontally to compare on a smaller screen →
| 01STEAM ACCOUNT HOLDERUser API KeyA key registered to a user’s account. |
02GAME DEVELOPER / PUBLISHERPublisher API KeyA key managed by a Steamworks publisher. |
03LOGGED-IN STEAM SESSIONSession JWTThe browser’s webapi_token. |
|---|---|---|
| WHO GETS IT A Steam account holder. This is the personal user-key route. | WHO GETS IT A Steamworks publisher. An administrator creates the key for a publisher group. | WHO GETS IT A logged-in Steam user’s browser. The token comes from that active session. |
| WHERE IT COMES FROM Account-key registration.steamcommunity.com/ | WHERE IT COMES FROM Steamworks group administration.Steamworks → Users & Permissions → Manage Groups ↗The administrator chooses applications and key permissions. | WHERE IT COMES FROM The browser’s session configuration.steamcommunity.com/ |
| WHAT IT GIVES ACCESS TO Account data and user-key methods. The trade-record reference includes | WHAT IT GIVES ACCESS TO Publisher and game-server operations. Examples include player-ticket verification, purchases and inventory services, within the key’s permissions. | WHAT IT GIVES ACCESS TO Authenticated access in the user’s session context. CSGORoll documents using it to monitor the seller’s trades. |
| PERMISSIONS & IP CONTROLS The Steam user’s account context. Access is determined by which methods accept that key. The historical security record examines broad account access and its abuse. Read the key-security record ↗ | PERMISSIONS & IP CONTROLS App associations and permission groups. A publisher key can also be restricted to selected calling IP addresses. | PERMISSIONS & IP CONTROLS Subject, audience and session claims. The supplied JWT includes |
| LIFETIME & RENEWAL A registered, persistent credential. The historical investigation follows continued access after registration; Valve controls whether the key remains accepted. Registration and lifecycle evidence ↗ | LIFETIME & RENEWAL Managed through the publisher group. Group configuration, permissions and Valve’s access controls govern its use. | LIFETIME & RENEWAL Temporary session credential. Roll’s April 2024 instructions require daily replacement. The token carries an expiry time; the current code audit separately identifies the available renewal paths. |
| HOW IT REACHES A SERVER A key in an API request. Valve supports a request parameter or the | HOW IT REACHES A SERVER A request from a secure publisher server. The publisher host, | HOW IT REACHES A SERVER A token handed to the outside platform. Roll’s June 2024 announcement describes automatic collection, renewal and upload. Its current version 1.2 instead provides a token-copy popup for manual submission. |
| ROLE IN THIS INVESTIGATION The historical account-access route. The dossier follows key registration, consent attribution and trade substitution. Registration and consent exhibits ↗ | ROLE IN THIS INVESTIGATION The game-publisher integration route. This is the developer-side context people often mean when they say “Steam API.” | ROLE IN THIS INVESTIGATION The seller-session route documented by CSGORoll. Monitoring the Steam exchange feeds the operator’s decision to credit or release its own coins. |
CSGOROLL’S
DOCUMENTED ROUTE
DOCUMENTED ROUTE
Column 03: the seller’s Steam session.
The user supplies the token. The platform monitors the trade and controls the coin settlement.
START WITH THE TERMS
An API is an interface.
Access comes from a credential.
The phrase “Steam API” covers more than integration inside a game. Steam publishes both native game interfaces and HTTP services used by websites and account-based tools. Its own key documentation explicitly separates user keys from publisher keys.
- Steamworks SDK
- Libraries and interfaces a developer integrates into a game: achievements, friends, leaderboards and other Steam features.
- Steam Web API
- HTTP endpoints that software calls for data or operations. The method determines the authentication it requires.
- API key / session token
- The credential presented with a request. User keys, publisher keys and browser-session tokens belong to different account contexts.
- JWT
- A format that carries claims inside a token. It belongs to the credential layer.
Verification is a platform function.
Monitoring through a user’s token
After Steam’s API changes interrupted the previous P2P workflow, CSGORoll introduced a replacement: the seller supplies a token from their own logged-in Steam session.
The extension supplies the server
The extension workflow automatically collects, refreshes and sends the WebAPI token to CSGORoll’s servers. The user’s credential becomes part of the platform’s verification infrastructure.
The method changes. Control stays.
The later workflow adds inventory monitoring, user confirmation and platform-run disputes for token-free trades. The operator still decides how delivery is recognised and settlement proceeds.
EXHIBIT B / THE DECODED FIELDS
Read the credential
behind the label.
The supplied excerpt declares typ: JWT and alg: EdDSA. Its claims name a Steam account, the web:community audience and timestamps. “WebAPI token” is the field name; JWT identifies the token format.
In June 2024, CSGORoll made the destination explicit: its extension transmits your WebAPI token to our servers
.
- typ / alg
- JWT / EdDSA
- sub
- Steam account identifier
- aud
- ["web:community"]
- iat · nbf · exp
- Issued · valid from · expires
- jti
- Token identifier
- ip_subject
ip_confirmer - IP-related claims
Values redacted
Field transcription from the investigation notes. No live credential is reproduced.
EVERY FIELD IN THE SUPPLIED EXCERPT
Identity, time and issuer-defined context.
| Field | Meaning in this record | Role in the access decision |
|---|---|---|
typ | JWT: the declared token type. | Identifies the format being parsed. |
alg | EdDSA: the declared signing algorithm. | The signing layer protects integrity. |
iss | Issuer identifier. | Who issued the claims. |
sub | Subject: the Steam account identifier in the supplied notes. | Which account the token concerns. |
aud | Intended recipient; the excerpt contains web:community. | Audience validation, alongside the endpoint’s authorisation rules. |
iat | Issue time. | When the token was created. |
nbf | Earliest acceptance time. | The token is not valid before this time. |
exp | Expiry time. | The token must cease to be accepted at expiry. |
jti | Token identifier. | Identifies this token instance. |
oat, rt_exp | Additional timestamps listed in the supplied Steam payload. | Issuer-defined session metadata. Their exact processing is part of Steam’s implementation. |
ip_subject, ip_confirmer | IP-related fields, with addresses redacted. | Issuer-defined network context; enforcement depends on the receiving service. |
Standard claim definitions: RFC 7519, §4.1. Additional claim names: §4.3. The field values and names come from the supplied, redacted excerpt.
A compact signed JWT joins three base64url-encoded parts with dots. Select a part to see what it contributes.
{
"typ": "JWT",
"alg": "EdDSA"
}What kind of object is this?
The header declares the JWT type and EdDSA signature algorithm. These are the header values recorded in the supplied excerpt. The algorithm belongs to the signing layer.
TYPE + SIGNING METHOD{
"sub": "[SteamID redacted]",
"aud": ["web:community"],
"iss": "[issuer value omitted]",
"iat": "[issued timestamp]",
"nbf": "[valid-from timestamp]",
"exp": "[expiry timestamp]",
"oat": "[additional timestamp]",
"rt_exp": "[additional timestamp]",
"jti": "[token ID omitted]",
"ip_subject": "[redacted]",
"ip_confirmer": "[redacted]"
}Whose session context travels with it?
sub identifies the subject; aud identifies intended recipients. The standard timestamps record issuance, earliest acceptance and expiry. Steam’s additional fields carry issuer-specific session context.
The field-by-field table above separates standard JWT claims from Steam’s additional session metadata. All supplied field names are also preserved in the downloadable excerpt.
IDENTITY + AUDIENCE + TIMEENCODED HEADER + PAYLOADSignature integrity
Readable claims, verifiable integrity.
A signature covers the encoded header and payload. Verification checks that signed input with the appropriate key. Base64url encoding makes those first two parts readable; encryption is a separate mechanism.
This exhibit presents the supplied fields. The signature is represented structurally because the notes contain no complete signed token.
DECODING → CONTENT / VERIFICATION → INTEGRITYSwipe the diagram to inspect both sides.
01 / SESSION CONTEXT
The credential starts in the user’s Steam session.
Its account identifier, audience and timestamps travel in the token. CSGORoll’s documented seller workflow obtains this credential from the logged-in browser.
EXPIRY / RENEWAL / CONTINUED MONITORING
A short-lived token can support an ongoing commercial connection.
Roll’s April 2024 instructions require daily replacement. Its June 2024 announcement describes background collection, refresh and upload. The currently distributed Roll package uses a manual-copy popup; Empire’s separately audited extension implements session renewal. These are different implementations of the same dependency: the platform needs continuing information from the user’s Steam account to settle its own ledger.
CODE AUDIT / 10 OCTOBER 2026
Follow the session credential into the extension.
The current CSGORoll-linked package and SIH 2.11.12 were inspected for token extraction, renewal triggers, server transmission and trade-control paths. The appendix pins each finding to a version, file and hash, and separates the 2024 workflow from the currently distributed code.
Read the extension code audit ↗Before the session-token workflow: the user-key registration problem+
The Steam Dossier’s historical API-key case traces a credential registered through a compromised authenticated browser session. The relevant question is who actually performs the consent action: a person making a deliberate grant, or a script submitting the registration fields. Inspect the consent and registration record ↗
The documented trade-substitution pattern then follows monitoring, cancellation and a replacement offer, with the user’s confirmation attached to the substituted transaction. A persistent account credential and an active session become parts of the same abuse chain. Follow the documented substitution sequence ↗
Valve’s public Web API documentation describes website developers and account-key registration. Its API Terms are dated July 2010. This history belongs to user-account access and web services, alongside the separate Steamworks game-integration pathway.
Read the historical registration and trade-method exhibits ↗THE DOCUMENTED CONNECTION
- 01Steam session
The seller is logged in.
- 02Token handoff
The platform receives the session token.
- 03Trade monitoring
Delivery is checked through the documented workflow.
- 04Platform balance
Recognition and coin release follow the operator’s rules.
PUBLIC VISIBILITY / ITEM LINEAGE
The original-ID tracking route was removed.
The former IEconItems_730/GetPlayerItems endpoint exposed an item’s original identifier, which could be matched across inventory changes. Its closure in 2017 removed that public identifier from the tracking route. The engineering history describes the replacement approach using float, seed and paint properties. That matching method does not restore the original-ID record.
The consequence for this investigation is control over evidence: the user is asked to explain where an item went while the authoritative transfer records remain inside Steam. The dossier follows the loss of public tracing and what it means for a victim seeking a remedy.
Read the item-lineage and evidence-access record ↗IDENTITY / CREDENTIAL / ECONOMIC RESULT
Follow what each step gives the platform.
| Step | What moves through the system | What the operator obtains |
|---|---|---|
| Steam OpenID | Steam returns an authenticated SteamID to the service’s login flow; the request declares the service’s return address. | An authenticated Steam identity for the site’s user record. |
| Session-token handoff | The seller’s browser-session token is copied or collected by the extension. | The credential used in the documented trade-monitoring workflow. |
| Settlement decision | A Steam transfer is recognised under the platform’s verification rules. | The basis for crediting, withholding or releasing its own coin balance. |
The intermediary has moved into the account-access and accounting layers. Direct item delivery leaves that control in place.
The concrete interfaces: account data, trade records and publisher servers+
The Web API is organised as host → interface → method → version. A method is an operation; its required credential determines the account context accepted for that operation. The reference documentation therefore has to be read at both levels.
| Reference | What it describes | Why it matters here |
|---|---|---|
api.steampowered.com | HTTP services organised into named methods, with public and authenticated operations. | A website or server can make these calls; the interface extends beyond code running inside a game. |
IEconService | Trade history and offer records, including GetTradeHistory, GetTradeOffers and GetTradeOffer. | These methods document a user authentication key: a concrete account-access role outside game-client integration. |
ISteamUserAuth/on partner.steam-api.com | Publisher-side verification of a user’s authentication ticket. | The application’s identity and the publisher’s credential are explicit parts of the request. |
partner.steam-api.com | A separate HTTPS host for secure publisher servers; every request requires a publisher key. | Valve documents its availability, firewall setup and access requirements separately from the public host. |
Publisher-key documentation adds group administration, application associations, method permission groups and optional IP allowlists. CSGORoll’s documented token handoff instead starts with the seller’s Steam Community session. That is the access relationship the investigation follows.
02
THE INFRASTRUCTURE BELOW THE PLATFORM
Valve supplies the rails.
Two central authorities.
Different parts of the same exchange.
Valve governs the Steam account and item infrastructure. The outside operator governs its own ledger and access rules. Moving the item directly between users leaves both dependencies in place.
Steam’s agreement confines Wallet funds to its ecosystem and makes their use subject to Valve’s rules. The outside operator adds another controlled balance and another set of conditions around the same item economy.
CONTINUE THE INFRASTRUCTURE INVESTIGATION
Their rules. Their system.
The Steam Dossier examines the written rules, observed routes and enforcement record.
USERS, DEVELOPERS AND THE RIGHT TO DECIDE
Documentation does not give the community control.
Valve’s API terms reserve the ability to change the service or end access, including access for a particular application. Developers can build an integration and users can participate in it, but both remain dependent on decisions made by Valve. A public interface, a discussion board or a wiki does not transfer authority over those decisions to its readers.
That is the communication and accountability problem: the people affected need an attributable rule, change record and reasoned remedy, while the power to accept a credential, move an item or restore access stays with the platform.
Inspect our captured support, developer and wiki records ↗THREE POSITIONS / ONE ITEM ECONOMY
The right being defended runs through the system being restricted.
The real-money boundary
“Steam does not have a system for turning in-game items into real world currency.”
The commercial-use boundary
Steam’s rules reserve commercial permissions and explicitly list gambling under prohibited commercial activity. The participant’s account supplies the access through which an outside service can operate.
The transferability defence
Valve presents continued transfers as a consumer right. The same transfers let items leave one account for another while an outside platform handles the cash or coin side of the exchange.
Reading these positions together reveals the selective boundary. The system’s public description can stop at Steam’s Wallet, while its items travel through cash-priced outside markets. The right invoked for the collector is also the infrastructure used by the commercial service. The investigation follows the whole route across that boundary.
The July 2016 notices set a ten-day deadline. Our dossier follows that demand through the October response and into a route register where 26 main-domain warnings coexist with separate authentication hosts. The oldest of those recorded split routes reaches back to a March 2014 host registration. These dated records establish the routes examined at those times; domain age alone cannot establish uninterrupted operation. The enforcement question is whether an operator’s access was actually disabled and stayed disabled.
03Same filter.
20 URLS CHECKED
THE VISIBLE ENFORCEMENT LAYER
Same filter.
Different treatment.
We submitted the addresses in this investigation to Steam’s own Link Filter. CSGORoll, CSGOEmpire and Hellcase received an ordinary external-link notice with a continue link. The exact www.csgoroll.com variant also supplied a continue link. Sixteen other supplied addresses received a hard block. The difference is visible in Valve’s response.
Steam’s browser, Big Picture and the destination warning+
Valve’s original Big Picture presentation includes a built-in web browser. DARKNAVY’s June 2024 technical research describes Steam’s steamwebhelper as a Chromium Embedded Framework application rendering Store, Community and Friends content.
The browser surface and the Link Filter perform different jobs: one renders the page; the other controls Steam’s warning and onward link. The investigation follows that visible destination decision. For the supplied gambling addresses below, the wrapper either blocks the route or supplies a continue link. The wider dossier examines the client, overlay and Big Picture context.
Read the embedded-browser and authentication-route investigation ↗CSGOROLL.COM / SAVED RESPONSE
“Notice: You are leaving Steam.”
The returned page includes an onward link.
Open this Steam check ↗SKINPORT.COM / SAVED RESPONSE
“Link Blocked!”
NO CONTINUE LINKThe returned page withholds the onward link.
Open this Steam check ↗Showing all 20 recorded responses.
All 20 returned HTTP 200. The classification above comes from the page heading and the presence or absence of an actual continue anchor. Links open the current Steam response; the downloadable record preserves the dated observations.
Download the checks and timestamps ↗THE ENFORCEMENT QUESTION
The filter can withhold a destination link. For these three sites it supplied one.
What rule explains that dividing line?
THE WIDER ROUTE REGISTER
A blocked homepage. An available login route.
The Steam Dossier’s September register follows 26 filter-split pairs from the main domain to a separate Steam authentication host.
THE ADDRESS-STRING TEST
What does the filter react to?
We also submitted the csgofast name in five literal forms. Steam blocked the bare host, the .com and .hk forms, and a subdomain under example.com. The same text in the query-string example received an ordinary notice.
| Literal target submitted | Saved result |
|---|---|
| https://csgofast ↗ | Link Blocked |
| https://csgofast.com ↗ | Link Blocked |
| https://csgofast.hk ↗ | Link Blocked |
| https://example.com/?name=csgofast ↗ | Continue link present |
| https://csgofast.example.com ↗ | Link Blocked |
10 October 2026 · 19:09–19:10 UTC. The displayed links preserve the exact literal requests used for this comparison.
Download this five-input check ↗04107 RECORDS
THE PUBLIC RECORD
Inspect the evidence.
Sources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.
No matching records. Try a different term or select “All records”.
Methodology & source notes+
Research date: 10 October 2026. This investigation compares the platform’s public policies and dated technical records with Valve’s public statement, Steam’s agreement, account-restriction rules and the filed New York complaint. The supplied RWT warning is reproduced without alteration.
Technical changes are presented on a dated timeline. The Link Filter exhibits preserve literal request URLs, timestamps and observed headings and continue links. The JWT exhibit transcribes the supplied decoded fields with identifiers redacted. The interactive diagrams explain the documented control relationships. The legal-response analysis places Valve’s public framing beside the complaint and the documented control of accounts and items.
The analysis follows the economic mechanism: who supplies the credential, assigns value, verifies delivery, credits the balance, sets transfer conditions, enforces account restrictions and receives fees. Related findings link directly to the Steam Dossier’s underlying records.