Skip to main content
Create keys for checkout creation, reporting, and operational jobs. Each single key record can allow cs2, rust, or both; a checkout’s allowedGames must be a subset of that key’s game access. Do not create separate CS2 and Rust key records just to represent game access. The dashboard is the source for issuing, viewing metadata for, rotating, and revoking keys. Keys are not silently elevated. Issue a new key when adding access, update the server secret, deploy the change, and revoke the old key only after traffic has moved. If a key is exposed, revoke it first and investigate requests made with it. Never send a key from a browser or mobile client.
Scopes and game access are authorization controls, not a replacement for server-side order validation. Treat every API response as untrusted input and fulfill only from a confirmed completed result.
Next: use the Quickstart with a test key.