How to make a read-only Steamworks key

1. Create a group just for us

Sign in to Steamworks, open Users & Permissions → Manage Groups, and create a group named GameProof. Add the game you are listing to the group (Steam returns nothing for a game outside it) and add no users. The group only holds one key, and deleting the group takes it back.

2. Create the key with Financial ticked

On the group page click Create WebAPI Key. Key Permissions must include Financial (“Provides access to game sales data”). It is the only one we use, so the others can stay unticked: Microtransactions can run in-game purchase methods and Economy can change items and inventories, so leaving them off is safer. After saving, the key appears in the right-hand column.

3. Paste it on the connect page only

Copy the key, open Connect a read-only key, and paste the key and the AppID. The server checks it step by step, usually within a minute.

Do not test the key by pasting it into a browser address bar, and do not send it to anyone or paste it into a chat, an email, a screenshot or an AI assistant. If it got out, regenerate it in Steamworks.

How to take it back

Delete the GameProof group, or regenerate the key in Manage WebAPI Key. Our copy stops working at once and the game page keeps the last successful sync. You can also press Revoke in the console.

If a step fails

• The key should be 32 hex characters: copy the whole key from the group page, with no spaces around it.
• Steam refused this key: check the key has the Financial permission; the allow list is empty (or holds only 43.153.46.76); the key was not deleted. Then make a new key and try again.
• This key cannot read the game: check the game is on the same partner account and the AppID is right.
• Steam did not answer: try again in a few minutes. If it keeps failing, press Send us the result.

What this key can do

• A key with only the Financial permission can read sales and wishlist reports and nothing else: it cannot log in to Steamworks, change your store page, prices or builds, generate keys, or see player data.
• It can read more than wishlists: Steam has no key limited to wishlists or to one game, so the same key can read sales reports for every game on your account. By default we read this game’s wishlists and net sales per day and keep nothing about other games; sales stay private to you, and you can turn reading them off in the console.
• The key is sealed with a public key before it is stored; the web process holds no private key. Only the sync process can open it, and it uses the key for Steam requests only. It is never logged, never shown in errors, never emailed.
• Pages and the console show only the last four characters and a fingerprint.
• We call Steam only from the fixed IP 43.153.46.76. The key's allow list can stay empty.
• Delete the group or regenerate the key in Steamworks at any time. Our copy stops working immediately and the page keeps the last successful sync.