{
  "schema": "phishdestroy.reading-edition.v2",
  "schema_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/article.schema.json",
  "object_type": "Dated article reading edition with PDF digest",
  "id": "steam-access",
  "language": "en",
  "title": "Their credentials. Their infrastructure. — PhishDestroy",
  "author": "Agent Milo",
  "source_url": "https://phishdestroy.io/steam_dossier/steam-access",
  "source_file": "steam_dossier/steam-access.html",
  "source_html_sha256": "6d73894b2123fc2bc39dc7e3ae8fcf413c8e2d9c7b57f7ce1b12c53604fc789c",
  "exported_at": "2026-10-18T12:03:18.956Z",
  "edition_date": "2026-10-18",
  "scope": {
    "text": "Authored discussion and analytical tables from the current source HTML. Interactive controls and navigation are omitted; interactive datasets remain linked.",
    "omissions": [],
    "evidence_status": "The signature authenticates this publication, not the truth or authenticity of third-party evidence."
  },
  "pdf": {
    "filename": "steam-access.pdf",
    "url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/steam-access.pdf",
    "sha256": "4357ff20c967505eccdb21858c3de9d1024b9975b8766f8f64e3e6620ae14a04",
    "bytes": 561504,
    "pages": 33
  },
  "integrity": {
    "signed_object": "steam-access.content.json",
    "signature_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/steam-access.content.json.asc",
    "checksum_url": "https://phishdestroy.io/steam_dossier/exports/reading-2026-10-18/en/steam-access.content.json.sha256",
    "format": "ASCII-armored detached OpenPGP",
    "signing_key_fingerprint": "129FC7F39C40C69D2EF3C329BFCF9E8DD295EE01",
    "public_key": "https://phishdestroy.io/.well-known/pgp-key.txt",
    "scope": "Exact UTF-8 JSON bytes, including content and the PDF SHA-256. No cryptographic PDF document signature is asserted."
  },
  "license": {
    "identifier": "CC0-1.0",
    "application": "Authored material only; third-party material retains its own rights.",
    "rights_statement_url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/license-rights.json",
    "rights_statement_sha256": "80d67354f8e5efd65b03696be950fb0f95c188d0089b1604281d0a4daff3f4cb"
  },
  "content": {
    "text": "Contents · Live article\n\nEVIDENCE FILE 03 / THE INFRASTRUCTURE RECORD OWNERSHIP, GAMBLING & PLATFORM CONTROL10 OCT 2026 • WORKING PAPER\n\nSTEAM ACCESS\n\nTheir credentials. Their infrastructure.\n\nThe external service still needs the system Valve controls.\n\nINVESTIGATION BY AGENT MILO\n\nUser API keys, publisher keys and Steam session JWTs serve different purposes. This file follows the documented credential paths, the infrastructure beneath them and the dated Link Filter responses. Version-pinned code audits remain attached as separate evidence files.\n\nInspect the three credentials ↓Open the code audit ↗\nFOLLOW THE ACCESS RECORD\n01 / ISSUEA Steam credential.\n\nAccount identity, issuer-defined context and expiry.\n\n02 / USEA service receives access.\n\nDocumented collection and renewal paths, pinned to their versions.\n\n03 / ENFORCEA route can be examined.\n\nSaved requests, filter responses and the operator’s declared host.\n\nOriginal 11 October edition · complete text →Preserved original wording, alongside the current sections →\n01\n\nTOKENS & PERMISSIONS\n\nThree credentials in the trading system\n\nTHREE CREDENTIALS / THREE ACCOUNT CONTEXTS\n\nUser key. Publisher key. Session JWT.\n\nCompare who receives each credential, what it accesses and how it enters the skin-trading system.\n\nPHISHDESTROY / THE CONVENIENT CONFUSION\nCongratulations. The player is now the integration.\n\nAutomation is forbidden in the Subscriber Agreement. Meanwhile, an outside trading business teaches the player to supply the credentials its automated workflow needs. Whose automation is this—and whose account carries the consequences? [E09] §4.C\n\nFOR THE DEVELOPER\nApplications. Permissions. IP restrictions.\n\nA publisher needs an API to operate its game. Valve documents application associations, permission groups and optional calling-IP restrictions, and tells publishers to keep their keys on secure servers. A recognizable security model. [E16]\n\nFOR THE PLAYER\nCopy this. Hand it over. Repeat.\n\nWhy must a person selling a skin become a credential courier? In April 2024, CSGORoll told sellers to obtain a token from their Steam session. In June, it announced an extension to collect, refresh and send that token to its servers. Very convenient—for the business receiving access. [E04] [E05]\n\nWhat does the player gain: a game feature, or another account credential to hand to an outside operator? The dossier’s history of stolen inventories makes that a security question, not a terminology exercise. When one access route changes, the commercial system finds another route through the customer’s session. Read the original key-security investigation ↗\n\nCSGORoll’s own blog words: the P2P announcement presents the platform as the anti-scam enforcement layer — it bans scammers and gamblers, it says. In the same document it explains why Valve cannot ban the mechanism, because every trade belongs to a player’s account. Banning the bots, on this architecture, means banning the players. The operator’s security blog and the impossibility argument are the same sentence. [E04]\n\nTHE PDF / BOARDING-PASS LOGIC\n\nA boarding pass can be a PDF.\nSo every PDF is a boarding pass?\n\nJWT describes the token’s format. “WebAPI” is the label used in this workflow. Neither answers the question of whose account authorizes the request. A reassuring name does not turn a player’s session credential into a publisher’s controlled integration.\n\nThe format is JWT. The account is the player’s. The outside operator receives the credential. Valve’s answer should explain the access and the protection—not invite the user to admire the vocabulary. [E17] [E05] SIH’s token-return handler: read the actual code ↗\n\nThree columns · swipe horizontally to compare on a smaller screen →\n\nUser API Key, Publisher API Key and Session JWT compared using the same seven fields\n01STEAM ACCOUNT HOLDERUser\nAPI KeyA key registered to a user’s account.E16 · User-key documentation ↗\t02GAME DEVELOPER / PUBLISHERPublisher\nAPI KeyA key managed by a Steamworks publisher.E16 · Publisher-key documentation ↗\t03LOGGED-IN STEAM SESSIONSession\nJWTThe browser’s webapi_token.E04 · CSGORoll’s token instructions ↗\nWHO GETS IT\n\nA Steam account holder. This is the personal user-key route. [E16]\n\n\tWHO GETS IT\n\nA Steamworks publisher. An administrator creates the key for a publisher group. [E16]\n\n\tWHO GETS IT\n\nA logged-in Steam user’s browser. The token comes from that active session. [E04]\n\nWHERE IT COMES FROM\n\nAccount-key registration.steamcommunity.com/dev/apikey ↗The registration associates a domain with the account’s key.\n\n\tWHERE IT COMES FROM\n\nSteamworks group administration.Steamworks → Users & Permissions → Manage Groups ↗The administrator chooses applications and key permissions.\n\n\tWHERE IT COMES FROM\n\nThe browser’s session configuration.steamcommunity.com/pointssummary/ajaxgetasyncconfig ↗CSGORoll’s instructions identify the field webapi_token.\n\nWHAT IT GIVES ACCESS TO\n\nAccount data and user-key methods. The trade-record reference includes GetTradeHistory, GetTradeOffers and GetTradeOffer. [E44]\n\n\tWHAT IT GIVES ACCESS TO\n\nPublisher and game-server operations. Examples include player-ticket verification, purchases and inventory services, within the key’s permissions. [E16] [E45]\n\n\tWHAT IT GIVES ACCESS TO\n\nAuthenticated access in the user’s session context. CSGORoll documents using it to monitor the seller’s trades. [E04]\n\nPERMISSIONS & IP CONTROLS\n\nThe Steam user’s account context. Access is determined by which methods accept that key. The historical security record examines broad account access and its abuse. Read the key-security record ↗\n\n\tPERMISSIONS & IP CONTROLS\n\nApp associations and permission groups. A publisher key can also be restricted to selected calling IP addresses. [E16]\n\n\tPERMISSIONS & IP CONTROLS\n\nSubject, audience and session claims. The supplied JWT includes sub, aud: web:community and IP-related fields. Steam applies the access rules. [E17]\n\nLIFETIME & RENEWAL\n\nA registered, persistent credential. The historical investigation follows continued access after registration; Valve controls whether the key remains accepted. Registration and lifecycle evidence ↗\n\n\tLIFETIME & RENEWAL\n\nManaged through the publisher group. Group configuration, permissions and Valve’s access controls govern its use. [E16]\n\n\tLIFETIME & RENEWAL\n\nTemporary session credential. Roll’s April 2024 instructions require daily replacement. The token carries an expiry time; the current code audit separately identifies the available renewal paths. [E04]\n\nHOW IT REACHES A SERVER\n\nA key in an API request. Valve supports a request parameter or the x-webapi-key header. [E16]\n\n\tHOW IT REACHES A SERVER\n\nA request from a secure publisher server. The publisher host, partner.steam-api.com, requires a publisher key and HTTPS. [E43]\n\n\tHOW IT REACHES A SERVER\n\nA token handed to the outside platform. Roll’s June 2024 announcement describes automatic collection, renewal and upload. Its current version 1.2 instead provides a token-copy popup for manual submission. [E05]\n\nROLE IN THIS INVESTIGATION\n\nThe historical account-access route. The dossier follows key registration, consent attribution and trade substitution. Registration and consent exhibits ↗\n\n\tROLE IN THIS INVESTIGATION\n\nThe game-publisher integration route. This is the developer-side context people often mean when they say “Steam API.” [E23] [E45]\n\n\tROLE IN THIS INVESTIGATION\n\nThe seller-session route documented by CSGORoll. Monitoring the Steam exchange feeds the operator’s decision to credit or release its own coins. [E04] [E07]\n\nCSGOROLL’S\nDOCUMENTED ROUTE\n\nColumn 03: the seller’s Steam session.\nThe user supplies the token. The platform monitors the trade and controls the coin settlement.\n\nTHE STANDARDS LAG / PUBLIC, DATED, UNANSWERED\n\nThe standards were public. The dates are the record.\n\nSteam ships on the App Store and Google Play, sells through the major card processors, and consumes third-party APIs like any other large platform. Each of those relationships carries a published, dated security requirement that Valve must satisfy to keep operating. Nothing in this table is a private standard, an internal memo or a trade secret — every entry is a public document with a publication date. Set those dates against the dates on which Steam’s own Web API acquired the same protections. [E13]\n\nPublished external security requirements set against the Steam Web API’s own dates\nThe published standard\tThe date it took effect\tThe Steam Web API on the same question\nScoped authorisation\tOAuth 2.0 — RFC 6749, October 2012. Section 3.3 defines scope so a client receives only the access it asks for. It has been the default of every major platform API since.\tGranular scopes arrived on 16 January 2026. Before that, a single Steam Web API key carried full read and write over the account’s trades regardless of why it was issued — thirteen years and three months after the specification that defines the control.\nA second factor on privileged access\tPCI DSS 3.2, requirement 8.3 — mandatory from 1 February 2018 for all non-console administrative and all remote access to the cardholder data environment. Apple then required two-factor authentication of every Developer Program account holder from 27 February 2019: “developers with the Account Holder role in a developer program will need to enable two-factor authentication to sign in.”\tA second factor was required to create an API key from 4 December 2023. Until then a stolen session cookie was enough — no prompt on the account holder’s phone, no notification afterwards. Four years and nine months after Apple made Valve itself use a second factor merely to sign in to a developer portal.\nCredential lifecycle and revocation\tTwitch requires of every third-party application: “Your app must validate the OAuth token when it starts and on an hourly basis thereafter” — and retired its legacy v5 API outright on a published schedule, 28 February 2022.\tNo published key-lifecycle record. The 2023 change protected the creation endpoint; no Valve statement located with it addresses keys already registered, and no changelog accompanied the change at all. Whether pre-fix keys were invalidated cannot be established from public data.\n\nThe benchmark, from the parent dossier’s token comparison: a GitHub fine-grained token can be restricted to a single repository, read-only, with a mandatory thirty-day expiry, and it logs IP, user agent and timestamp on every call. The Steam Web API key was a single 32-character string carrying full trade authority — read, cancel, decline — never expiring, with no IP binding and no user-visible audit trail. Valve’s own developers manage open-source software on GitHub daily inside the first model; the monolithic key was what 130 million Steam players were issued. [E13]\n\n2012 → 2026\n\nThirteen years and three months.\nThat is the interval between RFC 6749 defining scoped authorisation and the Steam Web API acquiring granular scopes on 16 January 2026. No key-lifecycle record has ever been published.\n\nThe standards table in the parent dossier ↗The GitHub / Steam token comparison ↗\n\nSTART WITH THE TERMS\n\nAn API is an interface. Access comes from a credential.\n\nThe phrase “Steam API” covers more than integration inside a game. Steam publishes both native game interfaces and HTTP services used by websites and account-based tools. Its own key documentation explicitly separates user keys from publisher keys. [E16] [E34]\n\nSteamworks SDK\nLibraries and interfaces a developer integrates into a game: achievements, friends, leaderboards and other Steam features. [E23]\nSteam Web API\nHTTP endpoints that software calls for data or operations. The method determines the authentication it requires. [E43]\nAPI key / session token\nThe credential presented with a request. User keys, publisher keys and browser-session tokens belong to different account contexts.\nJWT\nA format that carries claims inside a token. It belongs to the credential layer.\n\nVerification is a platform function.\n\n02 APR 2024\nSteam restricts inventory visibility\n\nValve’s release notes introduce ten days of invisibility for purchased and traded Counter-Strike items when other users inspect an inventory. [E28]\n\n10 APR 2024\nMonitoring through a user’s token\n\nAfter Steam’s API changes interrupted the previous P2P workflow, CSGORoll introduced a replacement: the seller supplies a token from their own logged-in Steam session. [E04]\n\n25 JUN 2024\nThe extension supplies the server\n\nThe extension workflow automatically collects, refreshes and sends the WebAPI token to CSGORoll’s servers. The user’s credential becomes part of the platform’s verification infrastructure. [E05]\n\n01 OCT 2024\nThe method changes. Control stays.\n\nThe later workflow adds inventory monitoring, user confirmation and platform-run disputes for token-free trades. The operator still decides how delivery is recognised and settlement proceeds. [E06]\n\nHOW THE CONTROL WORKS\n\nIdentity. Monitoring. Settlement.\nIdentity\nSteam OpenID identifies the account used to sign in to the outside service. [E08]\nMonitoring\nThe documented WebAPI token supplies authenticated access for trade checks. JWT is a format for carrying claims; the receiving service determines the access it accepts. [E05] [E11]\nSettlement\nThe operator links the recognised trade to its own coin ledger and release rules. [E07]\n\nThe mechanism connects the user’s Steam activity to an accounting decision controlled by the platform.\n\nEXHIBIT B / THE DECODED FIELDS\n\nRead the credential behind the label.\n\nThe supplied excerpt declares typ: JWT and alg: EdDSA. Its claims name a Steam account, the web:community audience and timestamps. “WebAPI token” is the field name; JWT identifies the token format. [E17] [E11]\n\nIn June 2024, CSGORoll made the destination explicit: its extension transmits your WebAPI token to our servers. [E05]\n\nThe endpoint’s character: ajaxgetasyncconfig is undocumented and internal. Without a session it returns an empty shell — {\"success\":1,\"data\":[]} — with one, it hands the browser a signed JWT. Valve built it so Steam’s own site could call its own API; it was never built for a casino’s servers. No published contract, no scope negotiation, no revocation path for the third-party use documented here. And the session token travels as an Authorization: Bearer header, not in a URL — after the 2024 change it is the credential the trade methods accept. The credential changed; the third party watching your trades did not. [E04] [E17]\n\nInspect the redacted field record ↗\nSUPPLIED DECODED EXCERPTIDENTIFIERS REDACTED\ntyp / alg\nJWT / EdDSA\nsub\nSteam account identifier\naud\n[\"web:community\"]\niat · nbf · exp\nIssued · valid from · expires\njti\nToken identifier\nip_subject\nip_confirmer\nIP-related claims\nValues redacted\n\nField transcription from the investigation notes. No live credential is reproduced.\n\nEVERY FIELD IN THE SUPPLIED EXCERPT\n\nIdentity, time and issuer-defined context.\nHow to read the supplied JWT without confusing a field with a permission\nField\tMeaning in this record\tRole in the access decision\ntyp\tJWT: the declared token type.\tIdentifies the format being parsed.\nalg\tEdDSA: the declared signing algorithm. [E25]\tThe signing layer protects integrity.\niss\tIssuer identifier.\tWho issued the claims.\nsub\tSubject: the Steam account identifier in the supplied notes.\tWhich account the token concerns.\naud\tIntended recipient; the excerpt contains web:community.\tAudience validation, alongside the endpoint’s authorisation rules.\niat\tIssue time.\tWhen the token was created.\nnbf\tEarliest acceptance time.\tThe token is not valid before this time.\nexp\tExpiry time.\tThe token must cease to be accepted at expiry.\njti\tToken identifier.\tIdentifies this token instance.\noat, rt_exp\tAdditional timestamps listed in the supplied Steam payload.\tIssuer-defined session metadata. Their exact processing is part of Steam’s implementation.\nip_subject, ip_confirmer\tIP-related fields, with addresses redacted.\tIssuer-defined network context; enforcement depends on the receiving service.\n\nStandard claim definitions: RFC 7519, §4.1. Additional claim names: §4.3. The field values and names come from the supplied, redacted excerpt. [E11] [E17]\n\nSIGNED JWT / THREE PARTSANNOTATED STRUCTURE\n\nA compact signed JWT joins three base64url-encoded parts with dots. Select a part to see what it contributes. [E24]\n\n{\n  \"typ\": \"JWT\",\n  \"alg\": \"EdDSA\"\n}\nWhat kind of object is this?\n\nThe header declares the JWT type and EdDSA signature algorithm. These are the header values recorded in the supplied excerpt. The algorithm belongs to the signing layer. [E17] [E25]\n\nTYPE + SIGNING METHOD\n{\n  \"sub\": \"[SteamID redacted]\",\n  \"aud\": [\"web:community\"],\n  \"iss\": \"[issuer value omitted]\",\n  \"iat\": \"[issued timestamp]\",\n  \"nbf\": \"[valid-from timestamp]\",\n  \"exp\": \"[expiry timestamp]\",\n  \"oat\": \"[additional timestamp]\",\n  \"rt_exp\": \"[additional timestamp]\",\n  \"jti\": \"[token ID omitted]\",\n  \"ip_subject\": \"[redacted]\",\n  \"ip_confirmer\": \"[redacted]\"\n}\nWhose session context travels with it?\n\nsub identifies the subject; aud identifies intended recipients. The standard timestamps record issuance, earliest acceptance and expiry. Steam’s additional fields carry issuer-specific session context. [E11]\n\nThe field-by-field table above separates standard JWT claims from Steam’s additional session metadata. All supplied field names are also preserved in the downloadable excerpt.\n\nIDENTITY + AUDIENCE + TIME\nENCODED HEADER + PAYLOADSignature integrity\nReadable claims, verifiable integrity.\n\nA signature covers the encoded header and payload. Verification checks that signed input with the appropriate key. Base64url encoding makes those first two parts readable; encryption is a separate mechanism. [E24]\n\nThis exhibit presents the supplied fields. The signature is represented structurally because the notes contain no complete signed token.\n\nDECODING → CONTENT / VERIFICATION → INTEGRITY\nFOLLOW THE ACCESS / CONTROL MODEL\nSTEAM / USER ACCOUNT CONTEXT\nOUTSIDE PLATFORM / OPERATOR CONTEXT\nUser’s Steam session\nwebapi_token made available\nACCOUNT · AUDIENCE · EXPIRY\nCSGORoll servers\nReceive the user-supplied token\nMANUAL HANDOFF / EXTENSION\nTOKEN\nSteam trade records\nDelivery and trade status\nTHE ITEM MOVEMENT\nPlatform coin ledger\nRecognition and balance release\nTHE USER’S PLATFORM RETURN\nauthenticated trade checks\nTRADE STATUS\noperator rules\n\nSwipe the diagram to inspect both sides.\n\n01 / SESSION CONTEXT\n\nThe credential starts in the user’s Steam session.\n\nIts account identifier, audience and timestamps travel in the token. CSGORoll’s documented seller workflow obtains this credential from the logged-in browser.\n\nE04 · Read the documented workflow ↗ [E17 · Supplied fields]\n\nEXPIRY / RENEWAL / CONTINUED MONITORING\n\nA short-lived token can support an ongoing commercial connection.\n\nRoll’s April 2024 instructions require daily replacement. Its June 2024 announcement describes background collection, refresh and upload. The currently distributed Roll package uses a manual-copy popup; Empire’s separately audited extension implements session renewal. These are different implementations of the same dependency: the platform needs continuing information from the user’s Steam account to settle its own ledger. [E04] [E05]\n\nCODE AUDIT / 10 OCTOBER 2026\n\nFollow the session credential into the extension.\n\nThe current CSGORoll-linked package and SIH 2.11.12 were inspected for token extraction, renewal triggers, server transmission and trade-control paths. The appendix pins each finding to a version, file and hash, and separates the 2024 workflow from the currently distributed code.\n\nRead the extension code audit ↗\nBefore the session-token workflow: the user-key registration problem+\n\nThe Steam Dossier’s historical API-key case traces a credential registered through a compromised authenticated browser session. The consent action was not a person’s deliberate grant: the account holder never saw the key-registration page, and a script executed the headless POST that submitted the registration fields with the stolen session cookie — machine-injected consent. Steam Support nonetheless attributes the key to the account holder. Valve holds the registration and request records; publish who performed the consent action behind the key it attributed. Inspect the consent and registration record ↗\n\nThe documented trade-substitution pattern then follows monitoring, cancellation and a replacement offer, with the user’s confirmation attached to the substituted transaction. A persistent account credential and an active session become parts of the same abuse chain. Follow the documented substitution sequence ↗\n\nValve’s public Web API documentation describes website developers and account-key registration. Its API Terms are dated July 2010. This history belongs to user-account access and web services, alongside the separate Steamworks game-integration pathway. [E33] [E34]\n\nThe issuance record: Valve’s user-key page issued a 32-character hex key to any logged-in account in a single click — no terms confirmed, no verification, no email notification. A day-old account with nothing in it qualified. [E16] [E34]\n\nThe key had no expiry, no scopes and no IP binding: all-or-nothing account access, passed as a bare ?key= parameter in the URL — logged by proxies, cached by servers, preserved in links. “Endless session” is not a metaphor; it was the documented property of the credential. With that key a site could call GetPlayerSummaries, GetOwnedGames and the full IEconService trade set — reading the account’s economy with the owner’s eyes. For years this was the standard deposit path of every skin site. [E44]\n\nThe silent fix: until 4 December 2023, a stolen session cookie alone could register that full-privilege key — no password, no Steam Guard prompt, no notification to the person whose account it was. On that date Valve began requiring mobile confirmation for key registration, closing the cookie-only route — without a changelog, detected by users rather than announced, about seven years after Valve’s 2016 statement and roughly six after the scam panels the archive preserves. And Valve has published nothing about the keys minted before the fix: no statement located with the change addresses keys already registered, and whether pre-fix keys were invalidated cannot be established from public data. The key itself was built never to expire — the zombie-key reservoir, credentials minted from stolen cookies, invisible to their owners, absent from any record a data subject could inspect. The question every refund refusal turns on — is a key created on this account years ago still live? — is one only Valve can answer, and it has not. [E13] Read the vulnerability profile and the fix record ↗\n\nThe 2024 closure: Valve closed the key-protected trade methods — and the credential economy did not shrink, it migrated. Within days CSGORoll was instructing sellers to paste a live session token instead. Valve closed one door and the commercial system walked through the user’s own session. [E04]\n\nRead the historical registration and trade-method exhibits ↗\n\nTHE HIJACK WALKTHROUGH / RECONSTRUCTION OF THE PRE-2023 PATTERN\n\nThe victim never visits the key page.\n\nThe parent dossier’s interactive hijack simulation, promoted into this record. Before 2023, the stolen Steam session could register a persistent Web API key. That key let the attacker monitor and cancel the victim’s pending offer; the attacker’s clone account then sent the replacement. The victim’s mobile confirmation completed the substituted trade. The entry is ordinary phishing: a compromised friend account sends the link, the victim enters credentials and a Steam Guard code into a lookalike portal, and the phishing server captures the active steamLoginSecure session cookie. The second factor has been used, not bypassed — two-factor authentication protects the moment of login, not what the resulting session can do afterwards. The timings below are illustrative, not live measurements of the current platform; the sequence is the record. [E13]\n\nPHASE B / SILENT KEY REGISTRATION\nThe key is registered by a script.\nPOST steamcommunity.com/dev/ajaxregisterkey\nCookie: steamLoginSecure=<stolen session>\nBody: agreeToTerms=agreed&domain=localhost\n\nThe victim never saw the key-registration page. A script holding the stolen cookie executes the headless POST — and because a script has no real domain to give, it sends localhost, the value later found on the hijacked account. Valve returns a full-privilege master key. Pre-2023 this required no password, no Steam Guard approval and no notification, and the key came with no scope limit: a session cookie converted into a durable credential.\n\nPHASE C / THE TRADE SWAP\nThe legitimate trade is cancelled and cloned.\n\nThe script polls IEconService/GetTradeOffers. The moment the victim initiates a legitimate trade, the script cancels it — sub-second, no prompt to the account holder — and a clone bot sends an identical offer carrying the same name and avatar, dressed with the recipient’s real profile data from ISteamUser/GetPlayerSummaries. Steam sees valid API calls carrying a valid key issued to that account. Every call is correctly authenticated.\n\nTHE EXPLOIT COMPLETED\nThe confirmation is genuine. The offer is not.\n\nExpecting the mobile prompt for their original trade, the victim approves the replacement. The confirmation is authentic — made by the account holder, on a registered device — but the offer it confirms is not the one the user initiated. That is the record Steam Support reads when the complaint arrives, and the reason the archived complaints were closed as user error.\n\nFour documented endpoints do the whole job — none of them is a flaw\nEndpoint\tRole in the sequence\tWhat it contributes\nIEconService/GetTradeOffers\tPolls the account\tMonitors the account’s trade offers — the details of newly created, pending or modified offers, including offer IDs and the recipient’s profile. [E44]\nIEconService/CancelTradeOffer\tVoids the real trade\tProgrammatically invalidates the legitimate offer before the account holder completes the mobile confirmation.\nISteamUser/GetPlayerSummaries\tDresses the clone\tReturns the legitimate recipient’s profile name and avatar URL, so a prepared clone account can be dressed to match.\ndev/ajaxregisterkey\tMints the credential\tHistorically, any active steamLoginSecure cookie session could register a key — no Steam Guard confirmation on the mobile device, no notification to the account holder. [E34]\n\nThe consent checkbox was never clicked by a human. Under GDPR Article 7 and Article 4(11), consent must be a freely given, specific, informed and unambiguous indication of the data subject’s wishes — a headless POST carrying a stolen cookie is none of those things. It is a forged signature on a transfer of liability. The dossier’s position is that a terms-acceptance field submitted by a hostile script, with no page shown to the account holder, cannot meet that definition; whether it does is for the supervisory authority. [E13]\n\nFOUR ENDPOINTS\nNONE IS A FLAW\n\nA stolen session could mint durable account access.\nNo server exploit was required. The stolen session registered the key; the key supplied monitoring and cancellation; the clone account supplied the replacement offer. Steam accepted the credentials at each step. The defect was the authority granted without an effective check on who was exercising it. [E13]\n\nStep through the hijack simulation in the parent dossier ↗\n\nFIRST ABUSE / NOTIFICATION / FIX / REAPPEARANCE\n\nThe abuse mechanisms returned more than once. Publish the trail per mechanism.\n\nThe API-key registration route was restricted and reappeared through session tokens. Session theft was answered and returned through extensions reading the same cookies. For each mechanism, the record request aimed at Valve is the same trail: first abuse, first user notification, fix date, reappearance — and the losses carried in between. [E04] [E05]\n\nTHE DOCUMENTED CONNECTION\n01Steam session\n\nThe seller is logged in.\n\n02Token handoff\n\nThe platform receives the session token.\n\n03Trade monitoring\n\nDelivery is checked through the documented workflow.\n\n04Platform balance\n\nRecognition and coin release follow the operator’s rules.\n\nPUBLIC VISIBILITY / ITEM LINEAGE\n\nThe original-ID tracking route was removed.\n\nThe former IEconItems_730/GetPlayerItems endpoint exposed an item’s original identifier, which could be matched across inventory changes. Its closure in 2017 removed that public identifier from the tracking route. The engineering history describes the replacement approach using float, seed and paint properties. That matching method does not restore the original-ID record. [E48]\n\nThe consequence for this investigation is control over evidence: the user is asked to explain where an item went while the authoritative transfer records remain inside Steam. The dossier follows the loss of public tracing and what it means for a victim seeking a remedy.\n\nRead the item-lineage and evidence-access record ↗\n\nIDENTITY / CREDENTIAL / ECONOMIC RESULT\n\nFollow what each step gives the platform.\nThree different operations in one user journey\nStep\tWhat moves through the system\tWhat the operator obtains\nSteam OpenID\tSteam returns an authenticated SteamID to the service’s login flow; the request declares the service’s return address.\tAn authenticated Steam identity for the site’s user record. [E34]\nSession-token handoff\tThe seller’s browser-session token is copied or collected by the extension.\tThe credential used in the documented trade-monitoring workflow. [E05]\nSettlement decision\tA Steam transfer is recognised under the platform’s verification rules.\tThe basis for crediting, withholding or releasing its own coin balance. [E07]\n\nThe intermediary has moved into the account-access and accounting layers. Direct item delivery leaves that control in place.\n\nThe concrete interfaces: account data, trade records and publisher servers+\n\nThe Web API is organised as host → interface → method → version. A method is an operation; its required credential determines the account context accepted for that operation. The reference documentation therefore has to be read at both levels. [E43]\n\nConcrete technical examples behind the terminology\nReference\tWhat it describes\tWhy it matters here\napi.steampowered.com\tHTTP services organised into named methods, with public and authenticated operations.\tA website or server can make these calls; the interface extends beyond code running inside a game.\nIEconService\tTrade history and offer records, including GetTradeHistory, GetTradeOffers and GetTradeOffer.\tThese methods document a user authentication key: a concrete account-access role outside game-client integration. [E44]\nISteamUserAuth/AuthenticateUserTicket\non partner.steam-api.com\tPublisher-side verification of a user’s authentication ticket.\tThe application’s identity and the publisher’s credential are explicit parts of the request. [E45]\npartner.steam-api.com\tA separate HTTPS host for secure publisher servers; every request requires a publisher key.\tValve documents its availability, firewall setup and access requirements separately from the public host. [E43]\n\nThe publisher contour is engineered like a real API boundary: a key required on every request, 403 and a hard IP rate-limit without it, a host outside the shared Akamai cache, HTTPS only, documented CIDR ranges for firewalls — and publisher access scoped to the partner’s own AppIDs: leaderboards, micro-transactions, workshop moderation and finance calls through ISteamMicroTxn, ISteamLeaderboards, IPublishedFileService and IPartnerFinancialsService. Everything the user-key page lacked in 2010–2024 exists one layer up — for publishers. [E43] [E16]\n\nPublisher-key documentation adds group administration, application associations, method permission groups and optional IP allowlists. CSGORoll’s documented token handoff instead starts with the seller’s Steam Community session. That is the access relationship the investigation follows. [E16] [E04]\n\nOriginal Web API overview ↗JWT format reference ↗\nNEW / EMPIRE, ROLL & FAST\nTrade tracking. Session access.\n\nEmpire’s login-cookie extraction and inactive session-renewal tab; Roll’s two extension identities; Fast’s current SIH installation and permission flow. The code is pinned to downloaded packages and public frontend files.\n\nOpen the new investigation ↗\nRead the original 11 October wording\n\nPreserved verbatim from the supplied 11 October 2026 edition. “Today” and “currently” refer to that edition; its original estimates and formulations remain available alongside the dated text above.\n\nThe parent dossier’s interactive hijack simulation, promoted into this record. Before 2023, a Web API key registered on an account could read its inventory, cancel a pending trade offer and create a new one — and no trade-confirmation screen was shown to the account holder for any of those actions. The entry is ordinary phishing: a compromised friend account sends the link, the victim enters credentials and a Steam Guard code into a lookalike portal, and the phishing server captures the active steamLoginSecure session cookie. The second factor has been used, not bypassed — two-factor authentication protects the moment of login, not what the resulting session can do afterwards. The timings below are illustrative, not live measurements of the current platform; the sequence is the record. [E13]\n\nReturns the legitimate recipient’s profile name, avatar URL and level, so a prepared clone account can be dressed to match.\n\nThe only thing the attacker had to steal was the key. None of the four endpoints needed exploiting — a valid key calls them and Steam answers. Every call is correctly authenticated; the defect is what the key was allowed to do. [E13]\n\nOpen this passage in the complete original edition →\n02\n\nTHE INFRASTRUCTURE BELOW THE PLATFORM\n\nValve supplies the rails.\n\nTwo central authorities.\nDifferent parts of the same exchange.\n\nValve governs the Steam account and item infrastructure. The outside operator governs its own ledger and access rules. Moving the item directly between users leaves both dependencies in place.\n\nSteam’s agreement confines Wallet funds to its ecosystem and makes their use subject to Valve’s rules. The outside operator adds another controlled balance and another set of conditions around the same item economy. [E09]\n\n13 JUL2016VALVE / PUBLIC STATEMENT\nThe mechanism was already named.\n\nValve identified Steam authentication and automated account activity in skin gambling, said it had no business relationships with those sites, and stated that using those services to operate a gambling business was prohibited.\n\nE08 · Read Valve’s statement ↗\nS / D\nCONTINUE THE INFRASTRUCTURE INVESTIGATION\nTheir rules. Their system.\n\nThe Steam Dossier examines the written rules, observed routes and enforcement record.\n\n↗\n\nUSERS, DEVELOPERS AND THE RIGHT TO DECIDE\n\nDocumentation does not give the community control.\n\nValve’s API terms reserve the ability to change the service or end access, including access for a particular application. Developers can build an integration and users can participate in it, but both remain dependent on decisions made by Valve. A public interface, a discussion board or a wiki does not transfer authority over those decisions to its readers. [E33]\n\nThat is the communication and accountability problem: the people affected need an attributable rule, change record and reasoned remedy, while the power to accept a credential, move an item or restore access stays with the platform.\n\nInspect our captured support, developer and wiki records ↗\n\nTHREE POSITIONS / ONE ITEM ECONOMY\n\nThe right being defended runs through the system being restricted.\n13 JUL 2016\nThe real-money boundary\n“Steam does not have a system for turning in-game items into real world currency.”\n“We have no business relationships with any of these sites. We have never received any revenue from them. And Steam does not have a system for turning in-game items into real world currency.”\n\nThe full statement is the quote to test: ten years later, every clause is testable against the fee record, the sponsorship record and the $1 million sale. [E08] [E38]\n\n“Using the OpenID API and making the same web calls as Steam users to run a gambling business is not allowed by our API nor our user agreements.”\n\nIn 2026 the same web calls are made with a session token pasted by the user — and the calls are the user’s own. Valve wrote the rule in a form its own architecture evades. [E04]\n\nErik Johnson / Valve’s original statement ↗\nTHE RULEBOOK\nThe commercial-use boundary\n\nSteam’s rules reserve commercial permissions and explicitly list gambling under prohibited commercial activity. The participant’s account supplies the access through which an outside service can operate.\n\nSteam Online Conduct ↗\n11 MAR 2026\nThe transferability defence\n\nValve presents continued transfers as a consumer right. The same transfers let items leave one account for another while an outside platform handles the cash or coin side of the exchange.\n\nValve’s public response ↗\n\nReading these positions together reveals the selective boundary. The system’s public description can stop at Steam’s Wallet, while its items travel through cash-priced outside markets. The right invoked for the collector is also the infrastructure used by the commercial service. The investigation follows the whole route across that boundary.\n\n2016 / 2026\nONE SYSTEM\n\nBoth cannot be the company’s understanding of its own system.\n2016 — “Steam does not have a system for turning in-game items into real world currency.” 2026 — transferability is a right Valve refuses to remove, while the complaint records a $1 million sale. [E08] [E14] [E38]\n\nSubscriber Agreement analysis ↗Clauses against recorded platforms ↗The market above Steam’s ceiling ↓\nOCT2016VALVE / WSGC RESPONSE\nForty notices. Account-level enforcement.\n\nValve told the Washington State Gambling Commission it had sent cease-and-desist notices to more than forty sites and disabled associated Steam accounts, while defending Steam trading and OpenID. The response is the direct anchor for the closing demand below: publish when access was disabled, what returned and under whose control.\n\nE19 · Valve’s October 2016 response ↗\n\nThe July 2016 notices set a ten-day deadline. Our dossier follows that demand through the October response and into a route register where 26 main-domain warnings coexist with separate authentication hosts. The register counts 44 separate auth-host domains carrying Steam logins for third-party platforms beside those 26 blocked main domains — each a domain registered apart from the platform’s main address; the split is systematic, not incidental. [E13] The oldest recorded split route reaches back to a March 2014 host registration. The register preserves those dated checkpoints and identifies the mechanism Valve’s enforcement should have interrupted. Publish when access was disabled, what returned and under whose control.\n\nOpen letter and Washington record ↗July 2016 notices and dated history ↗The route register ↗\n03\n\nTHE VISIBLE ENFORCEMENT LAYER\n\nSame filter. Different treatment.\n20 URLS CHECKED\n\nWe submitted the addresses in this investigation to Steam’s own Link Filter. CSGORoll, CSGOEmpire and Hellcase received an ordinary external-link notice with a continue link. The exact www.csgoroll.com variant also supplied a continue link. Sixteen other supplied addresses received a hard block. The difference is visible in Valve’s response. [E18]\n\nSteam’s browser, Big Picture and the destination warning+\n\nValve’s original Big Picture presentation includes a built-in web browser. DARKNAVY’s June 2024 technical research describes Steam’s steamwebhelper as a Chromium Embedded Framework application rendering Store, Community and Friends content. [E46] [E47]\n\nThe browser surface and the Link Filter perform different jobs: one renders the page; the other controls Steam’s warning and onward link. The investigation follows that visible destination decision. For the supplied gambling addresses below, the wrapper either blocks the route or supplies a continue link. The wider dossier examines the client, overlay and Big Picture context.\n\nThe Link Filter’s character is a man-in-the-middle layer on every link Steam users exchange: Steam intercepts the destination, renders its own warning page, and decides whether to hand the user onward. The same interception Valve once needed bots for, repackaged as a “safety” feature whose block list Valve controls.\n\nRead the embedded-browser and authentication-route investigation ↗\n\nCSGOROLL.COM / SAVED RESPONSE\n\n“Notice: You are leaving Steam.”\n“Continue to external site”\n\nThe returned page includes an onward link.\n\nOpen this Steam check ↗\n\nSKINPORT.COM / SAVED RESPONSE\n\n“Link Blocked!”\nNO CONTINUE LINK\n\nThe returned page withholds the onward link.\n\nOpen this Steam check ↗\nCAPTURED 10 OCT 2026 · 19:02–19:03 UTC / WWW CHECK 20:27 UTC\n\nPublic HTTPS responses, without a signed-in Steam session.\n\nSaved Steam Link Filter responses for the supplied addresses\nAddress submitted\tObserved response\tContinue link\tOriginal URL\ncsgoroll.com ↗\tContinue link present\tYes\tSteam response ↗\nwww.csgoroll.com ↗\tContinue link present\tYes\tSteam response ↗\ncsgoempire.com ↗\tContinue link present\tYes\tSteam response ↗\nhellcase.com ↗\tContinue link present\tYes\tSteam response ↗\ncsgostrong.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgo500.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgocosmos.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgocasino.net ↗\tLink Blocked\tNo\tSteam response ↗\ncsgo2x.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgohouse.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgoatse.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgocash.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgobig.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgomassive.com ↗\tLink Blocked\tNo\tSteam response ↗\nskins2.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgopot.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgowild.com ↗\tLink Blocked\tNo\tSteam response ↗\nskinport.com ↗\tLink Blocked\tNo\tSteam response ↗\ngamdom.com ↗\tLink Blocked\tNo\tSteam response ↗\ncsgofast.hk ↗Supplied test address\tLink Blocked\tNo\tSteam response ↗\n\nShowing all 20 recorded responses.\n\nAll 20 returned HTTP 200. The classification above comes from the page heading and the presence or absence of an actual continue anchor. Links open the current Steam response; the downloadable record preserves the dated observations.\n\nDownload the checks and timestamps ↗\nTHE ENFORCEMENT QUESTION\n\nThe filter can withhold a destination link. For these three sites it supplied one.\nWhat rule explains that dividing line?\n\n26\nTHE WIDER ROUTE REGISTER\nA blocked homepage. An available login route.\n\nThe Steam Dossier’s September register follows 26 filter-split pairs from the main domain to a separate Steam authentication host.\n\n↗\n\nTHE ADDRESS-STRING TEST\n\nWhat does the filter react to?\n\nWe also submitted the csgofast name in five literal forms. Steam blocked the bare host, the .com and .hk forms, and a subdomain under example.com. The same text in the query-string example received an ordinary notice. [E36]\n\nThe filter’s own character is undocumented: Steam has never documented how the Link Filter decides. It appeared around 2016, without announcement, and its block list is not published. The only way to test the enforcement layer Valve actually ships is to submit addresses and record the answers — which is what this register does.\n\nFive literal address inputs and saved Steam responses\nLiteral target submitted\tSaved result\nhttps://csgofast ↗\tLink Blocked\nhttps://csgofast.com ↗\tLink Blocked\nhttps://csgofast.hk ↗\tLink Blocked\nhttps://example.com/?name=csgofast ↗\tContinue link present\nhttps://csgofast.example.com ↗\tLink Blocked\n\n10 October 2026 · 19:09–19:10 UTC. The displayed links preserve the exact literal requests used for this comparison.\n\nDownload this five-input check ↗\n\nTHE PHISHING AUDIT / 120 DOMAINS · 24 SEPTEMBER 2026\n\nThe filter reads the gambling list fluently. It has never ingested a phishing feed.\n\nThe parent dossier submitted 120 confirmed Steam-specific phishing domains to Valve’s own Link Filter in three historical cohorts, tested live on 24 September 2026. On the desktop, external defenses such as Google Safe Browsing and Microsoft SmartScreen intercept known phishing with full-screen warnings; inside Steam’s embedded browser — Big Picture, the in-game overlay, the Steam Deck — those defenses do not exist, and the Link Filter is the one barrier left. [E13] [E46] [E47]\n\nTargeted Steam sample: the 120 hosts in these three cohorts were selected for Steam phishing through favicon searches and checks for copied Steam sign-in or home-page interfaces. This deliberate selection is separate from the mixed public-list checks below.\n\n120 confirmed Steam-phishing domains, three cohorts, one filter\nCohort\tWhat was submitted\tPassed clean\n2021–2022\nlegacy phishing\tClassic trade-offer and item-drop campaigns. Even 4 to 5 years after being cataloged by community watchdogs, seven in ten of these hosts still open with no block.\t70.0% (28/40)\n2023–2024\nCS2-era phishing\tCampaigns impersonating Counter-Strike 2 releases and fake community appeals — cs2-steam.com, appealsteamcommunity.help — pass straight through.\t77.5% (31/40)\n2025–2026\nedge phishing\tServerless edge deploys and favicon clones on EdgeOne, Vercel and Cloudflare Pages — steamgifter.online and its kin — pass virtually unobstructed.\t92.5% (37/40)\nGambling mains\npositive control\tThe control every phishing audit needs: the filter’s own category.\t7 / 7 blocked\n\nAdditional public-list checks · 6 October 2026\n\n1,088,753 distinct hosts\n\nAdditional analysis of public lists: we did not find a suitable Steam-only public list for a larger census, so we checked lists we considered relevant. None is exclusively Steam scams or phishing; their results are reported separately.\n\nSteam Link Filter responses · percentage of all hosts in each list\nList\tTested hosts\tBlocked\tBlocked %\tOrdinary notice\nSteam / Discord feeds\t36,724\t1,759\t4.79%\t34,965\nPhishDestroy · community + main list\t1,086,734\t4,010\t0.37%\t1,082,629\n\nScroll horizontally to compare the results.\n\nWhy these lists?\n\nSteam / Discord feeds. DevSpen and Discord-AntiScam cover gaming-account phishing and related scams. They are close to the Steam ecosystem, but the combined list is not exclusively Steam phishing. DevSpen · Discord-AntiScam.\nPhishDestroy · community + main list. Our PhishDestroy community and main lists test broader phishing and scam coverage, including crypto. The supplied results also contain blocked crypto-themed hosts, such as app-metamask-kyc-auth.com, app-trezor-auth.com, so this is a relevant additional check, not a Steam-only sample. PhishDestroy destroylist.\n\nThe two runs contain 1,123,458 host records, with 34,705 hosts in both lists: 1,088,753 distinct hosts after deduplication. We do not pool their block rates.\n\nMethod & verification\n\nBlocked % = BLOCKED ÷ all tested hosts in that row. The PhishDestroy run also has 78 ERROR, 15 UNKNOWN and 2 INTERNAL results; these 95 are included in the denominator, not counted as ordinary notices. The Steam / Discord run has no residual statuses.\n\nALLOWED means the ordinary “You are leaving Steam” notice was recorded, not that the destination is safe. These dated results measure the supplied lists; they do not establish that every site was still active or how Valve maintains its filter.\n\nMethodology · English · TXT\n\nRecounted results · JSONIndividual files & signatures · English\n\nThe filter’s one demonstrated fluency is the gambling list. Independent threat-intelligence platforms surface live Steam phishing kits in seconds by searching for Steam’s official favicon hash; Valve does not sync with external feeds, does not run hash-based threat hunting, and manually intervenes when compelled by regulators — the 2016 WSGC gambling order — or to protect its trademarked domain strings. The filter reads the gambling list fluently; it has never ingested a phishing feed. [E13]\n\nTELEMETRY,\nNOT PROTECTION\n\nA layer that passes 92.5% of live 2025–2026 phishing hosts is not a shield.\nIt presents a polite “You are leaving Steam” notice with a clickable proceed button, shifts the blame onto the click, and collects the telemetry of the click — while the theft passes through.\n\nRead the 120-domain longitudinal phishing audit ↗\n04\n\nTHE PUBLIC RECORD\n\nInspect the evidence.\n28 RECORDS\n\nSources cited in this article appear first. Select “All records” to inspect the complete 107-record register shared by the investigation; the dedicated evidence files retain their own detailed registers.\n\nMethodology & source notes\n\nResearch date: 10 October 2026. The credential comparison separates user API keys, publisher keys and session JWTs. Historical workflows retain their dates; the supplied JWT fields are transcribed with identifiers redacted. The package-specific checks continue in the extension audit and the three-operator comparison.\n\nThe Link Filter records preserve literal request URLs, timestamps, observed headings and continue links. Diagrams illustrate the documented paths; they do not execute account operations. The public-response and ownership analysis remains in Valve and enforcement.\n\nOriginal research scope · 10 October 2026\n\nResearch date: 10 October 2026. This investigation compares the platform’s public policies and dated technical records with Valve’s public statement, Steam’s agreement, account-restriction rules and the filed New York complaint. The supplied RWT warning is reproduced without alteration.\n\nTechnical changes are presented on a dated timeline. The Link Filter exhibits preserve literal request URLs, timestamps and observed headings and continue links. The JWT exhibit transcribes the supplied decoded fields with identifiers redacted. The interactive diagrams explain the documented control relationships. The legal-response analysis places Valve’s public framing beside the complaint and the documented control of accounts and items.\n\nThe analysis follows the economic mechanism: who supplies the credential, assigns value, verifies delivery, credits the balance, sets transfer conditions, enforces account restrictions and receives fees. Related findings link directly to the Steam Dossier’s underlying records.\n\nCited source records\nE09 · Steam Subscriber Agreement\n\nPublisher: Valve\n\nDate: Live agreement\n\nSupports: Valve’s licence grant, the absence of ownership interest in marketplace subscriptions, and Steam Wallet restrictions.\n\nScope: Relevant clauses: §1.C (personal account), §2.A/2.G (licence and commercial use), §3.C/3.D (Wallet and marketplace), §4.D and §9.C (enforcement).\n\nhttps://store.steampowered.com/agreement/?l=english\nE16 · Authentication using Web API Keys\n\nPublisher: Valve / Steamworks\n\nDate: Live documentation\n\nSupports: User-key registration and publisher keys with app associations, permission groups and configurable IP restrictions.\n\nScope: Sections: User Keys, Publisher Keys and Creating a Publisher Web API Key.\n\nhttps://partner.steamgames.com/doc/webapi_overview/auth\nE04 · WebAPI P2P Solution\n\nPublisher: CSGORoll\n\nDate: 10 Apr 2024\n\nSupports: A dated account of token collection for monitoring trades, including session dependence and expiration.\n\nScope: Technical record dated 10 April 2024; the subsequent workflow changes appear in E05–E07.\n\nhttps://www.csgoroll.com/blog/steam-p2p-solution/\nE05 · WebAPI Trading Extension\n\nPublisher: CSGORoll\n\nDate: 25 Jun 2024\n\nSupports: The announcement says the extension automatically collects and refreshes the Steam WebAPI token and transmits it to the operator’s servers.\n\nScope: The token collection, refresh and server-transmission workflow announced on 25 June 2024.\n\nhttps://www.csgoroll.com/blog/csgoroll-trading-extension/\nE17 · Decoded JWT fields — redacted transcription\n\nPublisher: Author-supplied notes\n\nDate: Supplied with this investigation\n\nSupports: Declared JWT type, EdDSA algorithm, Steam account subject, web:community audience and supplied timestamp and IP-related field names.\n\nScope: Field transcription with account and IP identifiers redacted. Signature bytes were not supplied.\n\nhttps://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json\nE44 · IEconService — trade history and offer records\n\nPublisher: Valve / Steamworks\n\nDate: Live documentation\n\nSupports: GetTradeHistory, GetTradeOffers and GetTradeOffer as concrete examples of account-economy methods.\n\nScope: Method reference used to explain what a trading API exposes.\n\nhttps://partner.steamgames.com/doc/webapi/IEconService\nE45 · ISteamUserAuth — publisher ticket authentication\n\nPublisher: Valve / Steamworks\n\nDate: Live documentation\n\nSupports: AuthenticateUserTicket on the publisher host, its publisher key, application ID and ticket parameters.\n\nScope: A concrete example of the publisher-server access relationship.\n\nhttps://partner.steamgames.com/doc/webapi/ISteamUserAuth\nE43 · Web API Overview — public and publisher hosts\n\nPublisher: Valve / Steamworks\n\nDate: Live documentation\n\nSupports: HTTP method structure, public and authenticated operations, publisher host requirements and access configuration.\n\nScope: The host and request layer underlying the credential comparison.\n\nhttps://partner.steamgames.com/doc/webapi_overview\nE23 · Steamworks API Overview — native game integration\n\nPublisher: Valve / Steamworks\n\nDate: Live documentation\n\nSupports: The native Steamworks SDK, C++ interfaces, libraries, initialization and game feature integration.\n\nScope: The game-integration layer contrasted with the HTTP Web API and its account credentials.\n\nhttps://partner.steamgames.com/doc/sdk/api\nE07 · Trade Protection Update\n\nPublisher: CSGORoll\n\nDate: 16 Jul 2025\n\nSupports: Coin-release timing during the seven-day protection window, tier-dependent instant access and consequences for reversals.\n\nScope: The coin-release mechanism described on 16 July 2025; tiers and limits are adjustable under that policy.\n\nhttps://www.csgoroll.com/blog/trade-protection-update/\nE13 · The Steam Dossier — rules, routes and accountability\n\nPublisher: PhishDestroy\n\nDate: Related investigation\n\nSupports: The parent investigation supplies the historical registration and consent exhibits, transfer-substitution sequence, route register, ownership and recovery records, and correspondence used by this companion investigation.\n\nScope: The parent PhishDestroy investigation; linked as the wider editorial and infrastructure context.\n\nhttps://phishdestroy.io/steam_dossier/\nE34 · Steam Web API Documentation\n\nPublisher: Valve / Steam Community\n\nDate: Public developer documentation\n\nSupports: Website-developer use of Steam data, user-key registration and the Steam OpenID identity mechanism.\n\nScope: The public web-service documentation linked to Steam Community account-key registration.\n\nhttps://steamcommunity.com/dev?l=en\nE28 · Release notes — inventory visibility\n\nPublisher: Valve / Counter-Strike\n\nDate: 2 Apr 2024\n\nSupports: Purchased and traded Counter-Strike items made invisible for ten days to other users viewing a Steam inventory.\n\nScope: Dated official release-note archive, entry for 2 April 2024.\n\nhttps://store.steampowered.com/news/posts/?appids=730&enddate=1714088148&feed=steam_community_announcements\nE06 · New Escrow, Dispute and Penalty Systems for Trades\n\nPublisher: CSGORoll\n\nDate: 01 Oct 2024\n\nSupports: Platform-defined manual completion after ten minutes, disputes, escalating penalties and inventory-based verification; a token-free route was described for certain skins.\n\nScope: Dated record of the manual verification, dispute and penalty workflow introduced in October 2024.\n\nhttps://www.csgoroll.com/blog/new-trading-system/\nE08 · In-Game Item Trading Update\n\nPublisher: Valve\n\nDate: 13 Jul 2016\n\nSupports: Valve’s account of identity verification and automated trading used by gambling services, its stated prohibition and its denial of business relationships with those sites.\n\nScope: Valve’s public statement from July 2016, retained here as a historical infrastructure record.\n\nhttps://store.steampowered.com/oldnews/22883\nE11 · RFC 7519 — JSON Web Token\n\nPublisher: IETF / RFC Editor\n\nDate: May 2015\n\nSupports: JWT represents claims in a token format. A service uses its own verification and authorisation rules when accepting the token.\n\nScope: Technical definition of the JWT format; endpoint permissions are determined by the receiving service.\n\nhttps://www.rfc-editor.org/rfc/rfc7519\nE25 · RFC 8037 — EdDSA in JOSE\n\nPublisher: IETF / RFC Editor\n\nDate: Jan 2017\n\nSupports: The EdDSA algorithm identifier used for signatures in the JOSE framework.\n\nScope: Section 3.1; relevant to the declared alg value in the supplied header.\n\nhttps://www.rfc-editor.org/rfc/rfc8037\nE24 · RFC 7515 — JSON Web Signature\n\nPublisher: IETF / RFC Editor\n\nDate: May 2015\n\nSupports: Compact signed-token structure, encoded header and payload, signature input and verification.\n\nScope: Sections 3.1 and 5 describe compact serialization and signing/validation.\n\nhttps://www.rfc-editor.org/rfc/rfc7515\nE33 · Steam Web API Terms of Use\n\nPublisher: Valve\n\nDate: Page marked last updated July 2010\n\nSupports: The established API-key signup framework, applications and websites, confidentiality obligations and Valve’s access controls.\n\nScope: The terms describe the account-key service and the API access relationship.\n\nhttps://steamcommunity.com/dev/apiterms\nE48 · How FloatDB Tracks Skins — the original-ID endpoint and its closure\n\nPublisher: CSFloat engineering\n\nDate: 3 Jul 2020\n\nSupports: The former original-ID field, closure of its endpoint in 2017 and the replacement matching approach using float, seed and paint properties.\n\nScope: Firsthand technical history of item tracking and its limitations.\n\nhttps://blog.csfloat.com/how-floatdb-tracks-items/\nE38 · People of New York v. Valve Corporation — filed complaint\n\nPublisher: New York Attorney General / NYSCEF\n\nDate: 25 Feb 2026\n\nSupports: Court, filing date, index 450952/2026, allegations, statutory bases and requested remedies.\n\nScope: NYSCEF document 2; 52-page court-stamped complaint. Requested relief appears on PDF pages 50–51.\n\nhttps://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf\nE41 · Steam Online Conduct — commercial activity\n\nPublisher: Valve\n\nDate: Live rules\n\nSupports: Gambling is explicitly included under the commercial-activity prohibition.\n\nScope: Read beside the account-enforcement record and Valve’s public transferability language.\n\nhttps://store.steampowered.com/online_conduct/\nE14 · About the New York Attorney General lawsuit against Valve\n\nPublisher: Valve\n\nDate: 11 Mar 2026\n\nSupports: The public collectibles comparison, optional and cosmetic framing, transferability argument, account-ban total, privacy objections and legislative position.\n\nScope: Corporate public response dated 11 March 2026; linked alongside the filed complaint and the investigation’s analysis.\n\nhttps://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5\nE19 · October 2016 response to the Washington State Gambling Commission\n\nPublisher: Valve / legal correspondence\n\nDate: October 2016\n\nSupports: Valve’s explanation of Steam trading, OpenID, notices to more than forty sites and account-level enforcement.\n\nScope: Public document copy linked by the Steam Dossier; the letter itself is dated 17 October 2016.\n\nhttps://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist\nE18 · Link Filter — 20-URL observation record\n\nPublisher: PhishDestroy / public Steam responses\n\nDate: 10 Oct 2026 · 19:02–19:03 / 20:27 UTC\n\nSupports: Four ordinary notices with continue anchors and sixteen hard blocks for the exact supplied wrapper URLs, including both CSGORoll hostname variants.\n\nScope: Unauthenticated HTTPS requests; classification by returned page heading and continue-anchor presence. Exact URLs and timestamps preserved.\n\nhttps://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json\nE46 · Introducing Big Picture — the built-in web browser\n\nPublisher: Valve\n\nDate: Original product presentation\n\nSupports: Valve’s presentation of web browsing within the original Big Picture interface.\n\nScope: Historical product presentation, used to identify the browser surface discussed in the submitted notes.\n\nhttps://store.steampowered.com/bigpicture/\nE47 · Exploiting Steam: Usual and Unusual Ways in the CEF Framework\n\nPublisher: DARKNAVY\n\nDate: 27 Jun 2024\n\nSupports: Firsthand technical description of steamwebhelper and its Chromium Embedded Framework architecture.\n\nScope: Documents Steam’s embedded Chromium architecture and its exploitation history, dated June 2024. The shipped configuration, patch cadence and present protection of steamwebhelper are part of the record requested from Valve.\n\nhttps://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/\nE36 · Link Filter — literal-address comparison\n\nPublisher: PhishDestroy / public Steam responses\n\nDate: 10 Oct 2026 · 19:09–19:10 UTC\n\nSupports: Returned headings and continue anchors for five literal csgofast-related address probes.\n\nScope: Exact request strings and responses are preserved, including separate percent-encoded request results.\n\nhttps://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json",
    "headings": [
      {
        "level": 1,
        "text": "Their credentials. Their infrastructure.",
        "anchor": "pd-steam-access--hero-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#hero-title"
      },
      {
        "level": 2,
        "text": "Three credentials in the trading system",
        "anchor": "pd-steam-access--access-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access-title"
      },
      {
        "level": 3,
        "text": "User key. Publisher key. Session JWT.",
        "anchor": "pd-steam-access--heading-3",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#credentials"
      },
      {
        "level": 3,
        "text": "Congratulations. The player is now the integration.",
        "anchor": "pd-steam-access--credential-courier-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#credential-courier-title"
      },
      {
        "level": 4,
        "text": "Applications. Permissions. IP restrictions.",
        "anchor": "pd-steam-access--heading-5",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#credential-courier"
      },
      {
        "level": 4,
        "text": "Copy this. Hand it over. Repeat.",
        "anchor": "pd-steam-access--heading-6",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#credential-courier"
      },
      {
        "level": 3,
        "text": "The standards were public. The dates are the record.",
        "anchor": "pd-steam-access--heading-7",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#standards-lag"
      },
      {
        "level": 3,
        "text": "An API is an interface. Access comes from a credential.",
        "anchor": "pd-steam-access--heading-8",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "Steam restricts inventory visibility",
        "anchor": "pd-steam-access--heading-9",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "Monitoring through a user’s token",
        "anchor": "pd-steam-access--heading-10",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "The extension supplies the server",
        "anchor": "pd-steam-access--heading-11",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "The method changes. Control stays.",
        "anchor": "pd-steam-access--heading-12",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "Identity. Monitoring. Settlement.",
        "anchor": "pd-steam-access--heading-13",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access"
      },
      {
        "level": 3,
        "text": "Read the credential behind the label.",
        "anchor": "pd-steam-access--heading-14",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#jwt-exhibit"
      },
      {
        "level": 3,
        "text": "Identity, time and issuer-defined context.",
        "anchor": "pd-steam-access--heading-15",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#jwt-fields"
      },
      {
        "level": 4,
        "text": "What kind of object is this?",
        "anchor": "pd-steam-access--heading-16",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#jwt-panel-header"
      },
      {
        "level": 4,
        "text": "Whose session context travels with it?",
        "anchor": "pd-steam-access--heading-17",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#jwt-panel-payload"
      },
      {
        "level": 4,
        "text": "Readable claims, verifiable integrity.",
        "anchor": "pd-steam-access--heading-18",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#jwt-panel-signature"
      },
      {
        "level": 4,
        "text": "The credential starts in the user’s Steam session.",
        "anchor": "pd-steam-access--token-stage-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#token-stage-title"
      },
      {
        "level": 4,
        "text": "A short-lived token can support an ongoing commercial connection.",
        "anchor": "pd-steam-access--heading-20",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#token-continuity"
      },
      {
        "level": 4,
        "text": "Follow the session credential into the extension.",
        "anchor": "pd-steam-access--heading-21",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#extension-code-audit"
      },
      {
        "level": 3,
        "text": "The victim never visits the key page.",
        "anchor": "pd-steam-access--heading-22",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#hijack-walkthrough"
      },
      {
        "level": 4,
        "text": "The key is registered by a script.",
        "anchor": "pd-steam-access--heading-23",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#hijack-walkthrough"
      },
      {
        "level": 4,
        "text": "The legitimate trade is cancelled and cloned.",
        "anchor": "pd-steam-access--heading-24",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#hijack-walkthrough"
      },
      {
        "level": 4,
        "text": "The confirmation is genuine. The offer is not.",
        "anchor": "pd-steam-access--heading-25",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#hijack-walkthrough"
      },
      {
        "level": 4,
        "text": "The abuse mechanisms returned more than once. Publish the trail per mechanism.",
        "anchor": "pd-steam-access--heading-26",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#reappearance-demand"
      },
      {
        "level": 4,
        "text": "The original-ID tracking route was removed.",
        "anchor": "pd-steam-access--heading-27",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#public-tracing"
      },
      {
        "level": 3,
        "text": "Follow what each step gives the platform.",
        "anchor": "pd-steam-access--heading-28",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#access-paths"
      },
      {
        "level": 3,
        "text": "Trade tracking. Session access.",
        "anchor": "pd-steam-access--heading-29",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#session-access-update"
      },
      {
        "level": 2,
        "text": "Valve supplies the rails.",
        "anchor": "pd-steam-access--valve-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#valve-title"
      },
      {
        "level": 3,
        "text": "The mechanism was already named.",
        "anchor": "pd-steam-access--heading-31",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#valve"
      },
      {
        "level": 3,
        "text": "Their rules. Their system.",
        "anchor": "pd-steam-access--heading-32",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#valve"
      },
      {
        "level": 4,
        "text": "Documentation does not give the community control.",
        "anchor": "pd-steam-access--heading-33",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#platform-governance"
      },
      {
        "level": 3,
        "text": "The right being defended runs through the system being restricted.",
        "anchor": "pd-steam-access--heading-34",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#transferability-record"
      },
      {
        "level": 4,
        "text": "The real-money boundary",
        "anchor": "pd-steam-access--heading-35",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#transferability-record"
      },
      {
        "level": 4,
        "text": "The commercial-use boundary",
        "anchor": "pd-steam-access--heading-36",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#transferability-record"
      },
      {
        "level": 4,
        "text": "The transferability defence",
        "anchor": "pd-steam-access--heading-37",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#transferability-record"
      },
      {
        "level": 3,
        "text": "Forty notices. Account-level enforcement.",
        "anchor": "pd-steam-access--heading-38",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#wsgc-october-2016"
      },
      {
        "level": 2,
        "text": "Same filter. Different treatment.",
        "anchor": "pd-steam-access--link-filter-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#link-filter-title"
      },
      {
        "level": 3,
        "text": "“Notice: You are leaving Steam.”",
        "anchor": "pd-steam-access--heading-40",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#link-filter"
      },
      {
        "level": 3,
        "text": "“Link Blocked!”",
        "anchor": "pd-steam-access--heading-41",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#link-filter"
      },
      {
        "level": 3,
        "text": "A blocked homepage. An available login route.",
        "anchor": "pd-steam-access--heading-42",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#link-filter"
      },
      {
        "level": 3,
        "text": "What does the filter react to?",
        "anchor": "pd-steam-access--heading-43",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#filter-pattern"
      },
      {
        "level": 3,
        "text": "The filter reads the gambling list fluently. It has never ingested a phishing feed.",
        "anchor": "pd-steam-access--heading-44",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#phishing-coverage"
      },
      {
        "level": 4,
        "text": "1,088,753 distinct hosts",
        "anchor": "pd-steam-access--linkfilter-expanded-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#linkfilter-expanded-title"
      },
      {
        "level": 2,
        "text": "Inspect the evidence.",
        "anchor": "pd-steam-access--sources-title",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#sources-title"
      },
      {
        "level": 2,
        "text": "Cited source records",
        "anchor": "pd-steam-access--cited-sources",
        "source_url": "https://phishdestroy.io/steam_dossier/steam-access#sources"
      }
    ],
    "links": [
      {
        "label": "Live article",
        "url": "https://phishdestroy.io/steam_dossier/steam-access"
      },
      {
        "label": "Open the code audit ↗",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html"
      },
      {
        "label": "Original 11 October edition · complete text →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/steam-access.html"
      },
      {
        "label": "[E09] §4.C",
        "url": "https://store.steampowered.com/agreement/?l=english"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "Read the original key-security investigation ↗",
        "url": "https://phishdestroy.io/steam_dossier/#vulnerability-profile"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "SIH’s token-return handler: read the actual code ↗",
        "url": "https://phishdestroy.io/steam_dossier/csgofast-sih.html#SC31"
      },
      {
        "label": "E16 · User-key documentation ↗",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "E16 · Publisher-key documentation ↗",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "E04 · CSGORoll’s token instructions ↗",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "steamcommunity.com/dev/apikey ↗",
        "url": "https://steamcommunity.com/dev/apikey"
      },
      {
        "label": "Steamworks → Users & Permissions → Manage Groups ↗",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "steamcommunity.com/pointssummary/ajaxgetasyncconfig ↗",
        "url": "https://steamcommunity.com/pointssummary/ajaxgetasyncconfig"
      },
      {
        "label": "[E44]",
        "url": "https://partner.steamgames.com/doc/webapi/IEconService"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E45]",
        "url": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "Read the key-security record ↗",
        "url": "https://phishdestroy.io/steam_dossier/#vulnerability-profile"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "Registration and lifecycle evidence ↗",
        "url": "https://phishdestroy.io/steam_dossier/#vulnerability-profile"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E43]",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "Registration and consent exhibits ↗",
        "url": "https://phishdestroy.io/steam_dossier/#consent-analysis"
      },
      {
        "label": "[E23]",
        "url": "https://partner.steamgames.com/doc/sdk/api"
      },
      {
        "label": "[E45]",
        "url": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E07]",
        "url": "https://www.csgoroll.com/blog/trade-protection-update/"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "The standards table in the parent dossier ↗",
        "url": "https://phishdestroy.io/steam_dossier/#integration-paradox"
      },
      {
        "label": "The GitHub / Steam token comparison ↗",
        "url": "https://phishdestroy.io/steam_dossier/#token-comparator"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E34]",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "[E23]",
        "url": "https://partner.steamgames.com/doc/sdk/api"
      },
      {
        "label": "[E43]",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "[E28]",
        "url": "https://store.steampowered.com/news/posts/?appids=730&enddate=1714088148&feed=steam_community_announcements"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "[E06]",
        "url": "https://www.csgoroll.com/blog/new-trading-system/"
      },
      {
        "label": "[E08]",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "[E11]",
        "url": "https://www.rfc-editor.org/rfc/rfc7519"
      },
      {
        "label": "[E07]",
        "url": "https://www.csgoroll.com/blog/trade-protection-update/"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E11]",
        "url": "https://www.rfc-editor.org/rfc/rfc7519"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "Inspect the redacted field record ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E25]",
        "url": "https://www.rfc-editor.org/rfc/rfc8037"
      },
      {
        "label": "[E11]",
        "url": "https://www.rfc-editor.org/rfc/rfc7519"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E24]",
        "url": "https://www.rfc-editor.org/rfc/rfc7515"
      },
      {
        "label": "[E17]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E25]",
        "url": "https://www.rfc-editor.org/rfc/rfc8037"
      },
      {
        "label": "[E11]",
        "url": "https://www.rfc-editor.org/rfc/rfc7519"
      },
      {
        "label": "[E24]",
        "url": "https://www.rfc-editor.org/rfc/rfc7515"
      },
      {
        "label": "E04 · Read the documented workflow ↗",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E17 · Supplied fields]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "Read the extension code audit ↗",
        "url": "https://phishdestroy.io/steam_dossier/extension-audit.html"
      },
      {
        "label": "Inspect the consent and registration record ↗",
        "url": "https://phishdestroy.io/steam_dossier/#consent-analysis"
      },
      {
        "label": "Follow the documented substitution sequence ↗",
        "url": "https://phishdestroy.io/steam_dossier/#hijack-simulation"
      },
      {
        "label": "[E33]",
        "url": "https://steamcommunity.com/dev/apiterms"
      },
      {
        "label": "[E34]",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E34]",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "[E44]",
        "url": "https://partner.steamgames.com/doc/webapi/IEconService"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "Read the vulnerability profile and the fix record ↗",
        "url": "https://phishdestroy.io/steam_dossier/#vulnerability-profile"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "Read the historical registration and trade-method exhibits ↗",
        "url": "https://phishdestroy.io/steam_dossier/#api-reference"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E44]",
        "url": "https://partner.steamgames.com/doc/webapi/IEconService"
      },
      {
        "label": "[E34]",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "Step through the hijack simulation in the parent dossier ↗",
        "url": "https://phishdestroy.io/steam_dossier/#hijack-simulation"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "[E48]",
        "url": "https://blog.csfloat.com/how-floatdb-tracks-items/"
      },
      {
        "label": "Read the item-lineage and evidence-access record ↗",
        "url": "https://phishdestroy.io/steam_dossier/#evidence-blackout"
      },
      {
        "label": "[E34]",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "[E05]",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "[E07]",
        "url": "https://www.csgoroll.com/blog/trade-protection-update/"
      },
      {
        "label": "[E43]",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "[E44]",
        "url": "https://partner.steamgames.com/doc/webapi/IEconService"
      },
      {
        "label": "[E45]",
        "url": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth"
      },
      {
        "label": "[E43]",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "[E43]",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E16]",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "Original Web API overview ↗",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "JWT format reference ↗",
        "url": "https://www.jwt.io/"
      },
      {
        "label": "Open the new investigation ↗",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html"
      },
      {
        "label": "Open this passage in the complete original edition →",
        "url": "https://phishdestroy.io/steam_dossier/editions/2026-10-11-latest/steam-access.html#access"
      },
      {
        "label": "[E09]",
        "url": "https://store.steampowered.com/agreement/?l=english"
      },
      {
        "label": "E08 · Read Valve’s statement ↗",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "S / DCONTINUE THE INFRASTRUCTURE INVESTIGATIONTheir rules. Their system.The Steam Dossier examines the written rules, observed routes and enforcement record.↗",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E33]",
        "url": "https://steamcommunity.com/dev/apiterms"
      },
      {
        "label": "Inspect our captured support, developer and wiki records ↗",
        "url": "https://phishdestroy.io/steam_dossier/steam_evidence_archive"
      },
      {
        "label": "[E08]",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "[E38]",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "[E04]",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "Erik Johnson / Valve’s original statement ↗",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "Steam Online Conduct ↗",
        "url": "https://store.steampowered.com/online_conduct/"
      },
      {
        "label": "Valve’s public response ↗",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E08]",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "[E14]",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "[E38]",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "Subscriber Agreement analysis ↗",
        "url": "https://phishdestroy.io/steam_dossier/#tos-structural-void"
      },
      {
        "label": "Clauses against recorded platforms ↗",
        "url": "https://phishdestroy.io/steam_dossier/#legal-ledger-workspace-section"
      },
      {
        "label": "The market above Steam’s ceiling ↓",
        "url": "https://phishdestroy.io/steam_dossier/gambling-system.html#price-gap"
      },
      {
        "label": "E19 · Valve’s October 2016 response ↗",
        "url": "https://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "Open letter and Washington record ↗",
        "url": "https://phishdestroy.io/steam_dossier/#wsgc-public-address"
      },
      {
        "label": "July 2016 notices and dated history ↗",
        "url": "https://phishdestroy.io/steam_dossier/#case-study-section"
      },
      {
        "label": "The route register ↗",
        "url": "https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer"
      },
      {
        "label": "[E18]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json"
      },
      {
        "label": "[E46]",
        "url": "https://store.steampowered.com/bigpicture/"
      },
      {
        "label": "[E47]",
        "url": "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/"
      },
      {
        "label": "Read the embedded-browser and authentication-route investigation ↗",
        "url": "https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer"
      },
      {
        "label": "Open this Steam check ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoroll.com"
      },
      {
        "label": "Open this Steam check ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://skinport.com"
      },
      {
        "label": "csgoroll.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoroll.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoroll.com"
      },
      {
        "label": "www.csgoroll.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://www.csgoroll.com/"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://www.csgoroll.com/"
      },
      {
        "label": "csgoempire.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoempire.com/"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoempire.com/"
      },
      {
        "label": "hellcase.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://hellcase.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://hellcase.com"
      },
      {
        "label": "csgostrong.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgostrong.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgostrong.com"
      },
      {
        "label": "csgo500.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgo500.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgo500.com"
      },
      {
        "label": "csgocosmos.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocosmos.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocosmos.com"
      },
      {
        "label": "csgocasino.net ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocasino.net"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocasino.net"
      },
      {
        "label": "csgo2x.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgo2x.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgo2x.com"
      },
      {
        "label": "csgohouse.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgohouse.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgohouse.com"
      },
      {
        "label": "csgoatse.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoatse.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgoatse.com"
      },
      {
        "label": "csgocash.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocash.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgocash.com"
      },
      {
        "label": "csgobig.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgobig.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgobig.com"
      },
      {
        "label": "csgomassive.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgomassive.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgomassive.com"
      },
      {
        "label": "skins2.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://skins2.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://skins2.com"
      },
      {
        "label": "csgopot.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgopot.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgopot.com"
      },
      {
        "label": "csgowild.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgowild.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgowild.com"
      },
      {
        "label": "skinport.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://skinport.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://skinport.com"
      },
      {
        "label": "gamdom.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://gamdom.com"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://gamdom.com"
      },
      {
        "label": "csgofast.hk ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast.hk"
      },
      {
        "label": "Steam response ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast.hk"
      },
      {
        "label": "Download the checks and timestamps ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json"
      },
      {
        "label": "26THE WIDER ROUTE REGISTERA blocked homepage. An available login route.The Steam Dossier’s September register follows 26 filter-split pairs from the main domain to a separate Steam authentication host.↗",
        "url": "https://phishdestroy.io/steam_dossier/#proxy-bypass-explainer"
      },
      {
        "label": "[E36]",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json"
      },
      {
        "label": "https://csgofast ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast"
      },
      {
        "label": "https://csgofast.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast.com"
      },
      {
        "label": "https://csgofast.hk ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast.hk"
      },
      {
        "label": "https://example.com/?name=csgofast ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://example.com/?name=csgofast"
      },
      {
        "label": "https://csgofast.example.com ↗",
        "url": "https://steamcommunity.com/linkfilter/?url=https://csgofast.example.com"
      },
      {
        "label": "Download this five-input check ↗",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "[E46]",
        "url": "https://store.steampowered.com/bigpicture/"
      },
      {
        "label": "[E47]",
        "url": "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/"
      },
      {
        "label": "DevSpen",
        "url": "https://github.com/DevSpen/scam-links"
      },
      {
        "label": "Discord-AntiScam",
        "url": "https://github.com/Discord-AntiScam/scam-links"
      },
      {
        "label": "PhishDestroy destroylist",
        "url": "https://github.com/phishdestroy/destroylist"
      },
      {
        "label": "Methodology · English · TXT",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/methodology.txt"
      },
      {
        "label": "Recounted results · JSON",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/summary.json"
      },
      {
        "label": "Individual files & signatures · English",
        "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/"
      },
      {
        "label": "[E13]",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "Read the 120-domain longitudinal phishing audit ↗",
        "url": "https://phishdestroy.io/steam_dossier/#linkfilter-coverage"
      },
      {
        "label": "the extension audit",
        "url": "https://phishdestroy.io/steam_dossier/extension-audit.html"
      },
      {
        "label": "the three-operator comparison",
        "url": "https://phishdestroy.io/steam_dossier/trade-tracking.html"
      },
      {
        "label": "Valve and enforcement",
        "url": "https://phishdestroy.io/steam_dossier/valve-and-enforcement.html"
      },
      {
        "label": "https://store.steampowered.com/agreement/?l=english",
        "url": "https://store.steampowered.com/agreement/?l=english"
      },
      {
        "label": "https://partner.steamgames.com/doc/webapi_overview/auth",
        "url": "https://partner.steamgames.com/doc/webapi_overview/auth"
      },
      {
        "label": "https://www.csgoroll.com/blog/steam-p2p-solution/",
        "url": "https://www.csgoroll.com/blog/steam-p2p-solution/"
      },
      {
        "label": "https://www.csgoroll.com/blog/csgoroll-trading-extension/",
        "url": "https://www.csgoroll.com/blog/csgoroll-trading-extension/"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json"
      },
      {
        "label": "https://partner.steamgames.com/doc/webapi/IEconService",
        "url": "https://partner.steamgames.com/doc/webapi/IEconService"
      },
      {
        "label": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth",
        "url": "https://partner.steamgames.com/doc/webapi/ISteamUserAuth"
      },
      {
        "label": "https://partner.steamgames.com/doc/webapi_overview",
        "url": "https://partner.steamgames.com/doc/webapi_overview"
      },
      {
        "label": "https://partner.steamgames.com/doc/sdk/api",
        "url": "https://partner.steamgames.com/doc/sdk/api"
      },
      {
        "label": "https://www.csgoroll.com/blog/trade-protection-update/",
        "url": "https://www.csgoroll.com/blog/trade-protection-update/"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/",
        "url": "https://phishdestroy.io/steam_dossier/"
      },
      {
        "label": "https://steamcommunity.com/dev?l=en",
        "url": "https://steamcommunity.com/dev?l=en"
      },
      {
        "label": "https://store.steampowered.com/news/posts/?appids=730&enddate=1714088148&feed=steam_community_announcements",
        "url": "https://store.steampowered.com/news/posts/?appids=730&enddate=1714088148&feed=steam_community_announcements"
      },
      {
        "label": "https://www.csgoroll.com/blog/new-trading-system/",
        "url": "https://www.csgoroll.com/blog/new-trading-system/"
      },
      {
        "label": "https://store.steampowered.com/oldnews/22883",
        "url": "https://store.steampowered.com/oldnews/22883"
      },
      {
        "label": "https://www.rfc-editor.org/rfc/rfc7519",
        "url": "https://www.rfc-editor.org/rfc/rfc7519"
      },
      {
        "label": "https://www.rfc-editor.org/rfc/rfc8037",
        "url": "https://www.rfc-editor.org/rfc/rfc8037"
      },
      {
        "label": "https://www.rfc-editor.org/rfc/rfc7515",
        "url": "https://www.rfc-editor.org/rfc/rfc7515"
      },
      {
        "label": "https://steamcommunity.com/dev/apiterms",
        "url": "https://steamcommunity.com/dev/apiterms"
      },
      {
        "label": "https://blog.csfloat.com/how-floatdb-tracks-items/",
        "url": "https://blog.csfloat.com/how-floatdb-tracks-items/"
      },
      {
        "label": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf",
        "url": "https://ag.ny.gov/sites/default/files/court-filings/new-york-v-valve-corporation-complaint-2026.pdf"
      },
      {
        "label": "https://store.steampowered.com/online_conduct/",
        "url": "https://store.steampowered.com/online_conduct/"
      },
      {
        "label": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5",
        "url": "https://help.steampowered.com/en/faqs/view/6300-A6C4-519D-A3F5"
      },
      {
        "label": "https://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist",
        "url": "https://fr.scribd.com/document/328063293/Valve-s-Oct-18th-response-to-Washington-State-Gambling-Commission-s-cease-and-desist"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json"
      },
      {
        "label": "https://store.steampowered.com/bigpicture/",
        "url": "https://store.steampowered.com/bigpicture/"
      },
      {
        "label": "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/",
        "url": "https://www.darknavy.org/blog/exploiting_steam_usual_and_unusual_ways_in_the_cef_framework/"
      },
      {
        "label": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json",
        "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json"
      }
    ],
    "tables": [
      {
        "id": "table-1",
        "caption": "User API Key, Publisher API Key and Session JWT compared using the same seven fields",
        "rows": [
          [
            "01STEAM ACCOUNT HOLDERUser\nAPI KeyA key registered to a user’s account.E16 · User-key documentation ↗",
            "02GAME DEVELOPER / PUBLISHERPublisher\nAPI KeyA key managed by a Steamworks publisher.E16 · Publisher-key documentation ↗",
            "03LOGGED-IN STEAM SESSIONSession\nJWTThe browser’s webapi_token.E04 · CSGORoll’s token instructions ↗"
          ],
          [
            "WHO GETS IT\n\nA Steam account holder. This is the personal user-key route. [E16]",
            "WHO GETS IT\n\nA Steamworks publisher. An administrator creates the key for a publisher group. [E16]",
            "WHO GETS IT\n\nA logged-in Steam user’s browser. The token comes from that active session. [E04]"
          ],
          [
            "WHERE IT COMES FROM\n\nAccount-key registration.steamcommunity.com/dev/apikey ↗The registration associates a domain with the account’s key.",
            "WHERE IT COMES FROM\n\nSteamworks group administration.Steamworks → Users & Permissions → Manage Groups ↗The administrator chooses applications and key permissions.",
            "WHERE IT COMES FROM\n\nThe browser’s session configuration.steamcommunity.com/pointssummary/ajaxgetasyncconfig ↗CSGORoll’s instructions identify the field webapi_token."
          ],
          [
            "WHAT IT GIVES ACCESS TO\n\nAccount data and user-key methods. The trade-record reference includes GetTradeHistory, GetTradeOffers and GetTradeOffer. [E44]",
            "WHAT IT GIVES ACCESS TO\n\nPublisher and game-server operations. Examples include player-ticket verification, purchases and inventory services, within the key’s permissions. [E16] [E45]",
            "WHAT IT GIVES ACCESS TO\n\nAuthenticated access in the user’s session context. CSGORoll documents using it to monitor the seller’s trades. [E04]"
          ],
          [
            "PERMISSIONS & IP CONTROLS\n\nThe Steam user’s account context. Access is determined by which methods accept that key. The historical security record examines broad account access and its abuse. Read the key-security record ↗",
            "PERMISSIONS & IP CONTROLS\n\nApp associations and permission groups. A publisher key can also be restricted to selected calling IP addresses. [E16]",
            "PERMISSIONS & IP CONTROLS\n\nSubject, audience and session claims. The supplied JWT includes sub, aud: web:community and IP-related fields. Steam applies the access rules. [E17]"
          ],
          [
            "LIFETIME & RENEWAL\n\nA registered, persistent credential. The historical investigation follows continued access after registration; Valve controls whether the key remains accepted. Registration and lifecycle evidence ↗",
            "LIFETIME & RENEWAL\n\nManaged through the publisher group. Group configuration, permissions and Valve’s access controls govern its use. [E16]",
            "LIFETIME & RENEWAL\n\nTemporary session credential. Roll’s April 2024 instructions require daily replacement. The token carries an expiry time; the current code audit separately identifies the available renewal paths. [E04]"
          ],
          [
            "HOW IT REACHES A SERVER\n\nA key in an API request. Valve supports a request parameter or the x-webapi-key header. [E16]",
            "HOW IT REACHES A SERVER\n\nA request from a secure publisher server. The publisher host, partner.steam-api.com, requires a publisher key and HTTPS. [E43]",
            "HOW IT REACHES A SERVER\n\nA token handed to the outside platform. Roll’s June 2024 announcement describes automatic collection, renewal and upload. Its current version 1.2 instead provides a token-copy popup for manual submission. [E05]"
          ],
          [
            "ROLE IN THIS INVESTIGATION\n\nThe historical account-access route. The dossier follows key registration, consent attribution and trade substitution. Registration and consent exhibits ↗",
            "ROLE IN THIS INVESTIGATION\n\nThe game-publisher integration route. This is the developer-side context people often mean when they say “Steam API.” [E23] [E45]",
            "ROLE IN THIS INVESTIGATION\n\nThe seller-session route documented by CSGORoll. Monitoring the Steam exchange feeds the operator’s decision to credit or release its own coins. [E04] [E07]"
          ]
        ]
      },
      {
        "id": "table-2",
        "caption": "Published external security requirements set against the Steam Web API’s own dates",
        "rows": [
          [
            "The published standard",
            "The date it took effect",
            "The Steam Web API on the same question"
          ],
          [
            "Scoped authorisation",
            "OAuth 2.0 — RFC 6749, October 2012. Section 3.3 defines scope so a client receives only the access it asks for. It has been the default of every major platform API since.",
            "Granular scopes arrived on 16 January 2026. Before that, a single Steam Web API key carried full read and write over the account’s trades regardless of why it was issued — thirteen years and three months after the specification that defines the control."
          ],
          [
            "A second factor on privileged access",
            "PCI DSS 3.2, requirement 8.3 — mandatory from 1 February 2018 for all non-console administrative and all remote access to the cardholder data environment. Apple then required two-factor authentication of every Developer Program account holder from 27 February 2019: “developers with the Account Holder role in a developer program will need to enable two-factor authentication to sign in.”",
            "A second factor was required to create an API key from 4 December 2023. Until then a stolen session cookie was enough — no prompt on the account holder’s phone, no notification afterwards. Four years and nine months after Apple made Valve itself use a second factor merely to sign in to a developer portal."
          ],
          [
            "Credential lifecycle and revocation",
            "Twitch requires of every third-party application: “Your app must validate the OAuth token when it starts and on an hourly basis thereafter” — and retired its legacy v5 API outright on a published schedule, 28 February 2022.",
            "No published key-lifecycle record. The 2023 change protected the creation endpoint; no Valve statement located with it addresses keys already registered, and no changelog accompanied the change at all. Whether pre-fix keys were invalidated cannot be established from public data."
          ]
        ]
      },
      {
        "id": "table-3",
        "caption": "How to read the supplied JWT without confusing a field with a permission",
        "rows": [
          [
            "Field",
            "Meaning in this record",
            "Role in the access decision"
          ],
          [
            "typ",
            "JWT: the declared token type.",
            "Identifies the format being parsed."
          ],
          [
            "alg",
            "EdDSA: the declared signing algorithm. [E25]",
            "The signing layer protects integrity."
          ],
          [
            "iss",
            "Issuer identifier.",
            "Who issued the claims."
          ],
          [
            "sub",
            "Subject: the Steam account identifier in the supplied notes.",
            "Which account the token concerns."
          ],
          [
            "aud",
            "Intended recipient; the excerpt contains web:community.",
            "Audience validation, alongside the endpoint’s authorisation rules."
          ],
          [
            "iat",
            "Issue time.",
            "When the token was created."
          ],
          [
            "nbf",
            "Earliest acceptance time.",
            "The token is not valid before this time."
          ],
          [
            "exp",
            "Expiry time.",
            "The token must cease to be accepted at expiry."
          ],
          [
            "jti",
            "Token identifier.",
            "Identifies this token instance."
          ],
          [
            "oat, rt_exp",
            "Additional timestamps listed in the supplied Steam payload.",
            "Issuer-defined session metadata. Their exact processing is part of Steam’s implementation."
          ],
          [
            "ip_subject, ip_confirmer",
            "IP-related fields, with addresses redacted.",
            "Issuer-defined network context; enforcement depends on the receiving service."
          ]
        ]
      },
      {
        "id": "table-4",
        "caption": "Four documented endpoints do the whole job — none of them is a flaw",
        "rows": [
          [
            "Endpoint",
            "Role in the sequence",
            "What it contributes"
          ],
          [
            "IEconService/GetTradeOffers",
            "Polls the account",
            "Monitors the account’s trade offers — the details of newly created, pending or modified offers, including offer IDs and the recipient’s profile. [E44]"
          ],
          [
            "IEconService/CancelTradeOffer",
            "Voids the real trade",
            "Programmatically invalidates the legitimate offer before the account holder completes the mobile confirmation."
          ],
          [
            "ISteamUser/GetPlayerSummaries",
            "Dresses the clone",
            "Returns the legitimate recipient’s profile name and avatar URL, so a prepared clone account can be dressed to match."
          ],
          [
            "dev/ajaxregisterkey",
            "Mints the credential",
            "Historically, any active steamLoginSecure cookie session could register a key — no Steam Guard confirmation on the mobile device, no notification to the account holder. [E34]"
          ]
        ]
      },
      {
        "id": "table-5",
        "caption": "Three different operations in one user journey",
        "rows": [
          [
            "Step",
            "What moves through the system",
            "What the operator obtains"
          ],
          [
            "Steam OpenID",
            "Steam returns an authenticated SteamID to the service’s login flow; the request declares the service’s return address.",
            "An authenticated Steam identity for the site’s user record. [E34]"
          ],
          [
            "Session-token handoff",
            "The seller’s browser-session token is copied or collected by the extension.",
            "The credential used in the documented trade-monitoring workflow. [E05]"
          ],
          [
            "Settlement decision",
            "A Steam transfer is recognised under the platform’s verification rules.",
            "The basis for crediting, withholding or releasing its own coin balance. [E07]"
          ]
        ]
      },
      {
        "id": "table-6",
        "caption": "Concrete technical examples behind the terminology",
        "rows": [
          [
            "Reference",
            "What it describes",
            "Why it matters here"
          ],
          [
            "api.steampowered.com",
            "HTTP services organised into named methods, with public and authenticated operations.",
            "A website or server can make these calls; the interface extends beyond code running inside a game."
          ],
          [
            "IEconService",
            "Trade history and offer records, including GetTradeHistory, GetTradeOffers and GetTradeOffer.",
            "These methods document a user authentication key: a concrete account-access role outside game-client integration. [E44]"
          ],
          [
            "ISteamUserAuth/AuthenticateUserTicket\non partner.steam-api.com",
            "Publisher-side verification of a user’s authentication ticket.",
            "The application’s identity and the publisher’s credential are explicit parts of the request. [E45]"
          ],
          [
            "partner.steam-api.com",
            "A separate HTTPS host for secure publisher servers; every request requires a publisher key.",
            "Valve documents its availability, firewall setup and access requirements separately from the public host. [E43]"
          ]
        ]
      },
      {
        "id": "table-7",
        "caption": "Saved Steam Link Filter responses for the supplied addresses",
        "rows": [
          [
            "Address submitted",
            "Observed response",
            "Continue link",
            "Original URL"
          ],
          [
            "csgoroll.com ↗",
            "Continue link present",
            "Yes",
            "Steam response ↗"
          ],
          [
            "www.csgoroll.com ↗",
            "Continue link present",
            "Yes",
            "Steam response ↗"
          ],
          [
            "csgoempire.com ↗",
            "Continue link present",
            "Yes",
            "Steam response ↗"
          ],
          [
            "hellcase.com ↗",
            "Continue link present",
            "Yes",
            "Steam response ↗"
          ],
          [
            "csgostrong.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgo500.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgocosmos.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgocasino.net ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgo2x.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgohouse.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgoatse.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgocash.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgobig.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgomassive.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "skins2.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgopot.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgowild.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "skinport.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "gamdom.com ↗",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ],
          [
            "csgofast.hk ↗Supplied test address",
            "Link Blocked",
            "No",
            "Steam response ↗"
          ]
        ]
      },
      {
        "id": "table-8",
        "caption": "Five literal address inputs and saved Steam responses",
        "rows": [
          [
            "Literal target submitted",
            "Saved result"
          ],
          [
            "https://csgofast ↗",
            "Link Blocked"
          ],
          [
            "https://csgofast.com ↗",
            "Link Blocked"
          ],
          [
            "https://csgofast.hk ↗",
            "Link Blocked"
          ],
          [
            "https://example.com/?name=csgofast ↗",
            "Continue link present"
          ],
          [
            "https://csgofast.example.com ↗",
            "Link Blocked"
          ]
        ]
      },
      {
        "id": "table-9",
        "caption": "120 confirmed Steam-phishing domains, three cohorts, one filter",
        "rows": [
          [
            "Cohort",
            "What was submitted",
            "Passed clean"
          ],
          [
            "2021–2022\nlegacy phishing",
            "Classic trade-offer and item-drop campaigns. Even 4 to 5 years after being cataloged by community watchdogs, seven in ten of these hosts still open with no block.",
            "70.0% (28/40)"
          ],
          [
            "2023–2024\nCS2-era phishing",
            "Campaigns impersonating Counter-Strike 2 releases and fake community appeals — cs2-steam.com, appealsteamcommunity.help — pass straight through.",
            "77.5% (31/40)"
          ],
          [
            "2025–2026\nedge phishing",
            "Serverless edge deploys and favicon clones on EdgeOne, Vercel and Cloudflare Pages — steamgifter.online and its kin — pass virtually unobstructed.",
            "92.5% (37/40)"
          ],
          [
            "Gambling mains\npositive control",
            "The control every phishing audit needs: the filter’s own category.",
            "7 / 7 blocked"
          ]
        ]
      },
      {
        "id": "table-10",
        "caption": "Steam Link Filter responses · percentage of all hosts in each list",
        "rows": [
          [
            "List",
            "Tested hosts",
            "Blocked",
            "Blocked %",
            "Ordinary notice"
          ],
          [
            "Steam / Discord feeds",
            "36,724",
            "1,759",
            "4.79%",
            "34,965"
          ],
          [
            "PhishDestroy · community + main list",
            "1,086,734",
            "4,010",
            "0.37%",
            "1,082,629"
          ]
        ]
      }
    ],
    "cited_source_ids": [
      "E09",
      "E16",
      "E04",
      "E05",
      "E17",
      "E44",
      "E45",
      "E43",
      "E23",
      "E07",
      "E13",
      "E34",
      "E28",
      "E06",
      "E08",
      "E11",
      "E25",
      "E24",
      "E33",
      "E48",
      "E38",
      "E41",
      "E14",
      "E19",
      "E18",
      "E46",
      "E47",
      "E36"
    ]
  },
  "resources": [
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/jwt-field-excerpt.json",
      "sha256": "966c5f133dc59b83950c84d158a4b2b893bac02e5d0f7b5fa002f855d094bb43",
      "bytes": 712
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-2026-10-10.json",
      "sha256": "7ffb3063cc0b18c58ab25fa6ea8313a536457369b82d0841ecfe3e3d1406a549",
      "bytes": 9476
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/case_assets/assets/evidence/linkfilter-pattern-2026-10-10.json",
      "sha256": "3a77f8fa56d3d2f1f476f83fb93c1477227be87725fb673b4e0f7b0f4d80a531",
      "bytes": 5890
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/methodology.txt",
      "sha256": "42d02ddb50961ca8f81bba18fd6a6c57931490e8ccab1fd9174cee5f8454e707",
      "bytes": 4336
    },
    {
      "url": "https://phishdestroy.io/steam_dossier/steam_tos_assets/linkfilter-audit-2026-10-06/summary.json",
      "sha256": "653a1b345b834b2cb94d4aa08fcfa7d06435c0c6afb5a557c6e6519d7d9fa295",
      "bytes": 5663
    }
  ]
}