Skip to main content

Developer API

API reference & key management

Section 01

API Keys

Sign in to manage API keys

Create and manage your keys from your account.

Section 02

Authentication

All API requests require an API key passed as a Bearer token in the Authorization header.

Authorization: Bearer sc_your_api_key_here
  • Creating, rotating, or revoking a key is a step-up action - a fresh 2FA code if 2FA is enabled, otherwise a fresh emailed one-time code. Listing your keys never requires step-up.
  • Keys belonging to a suspended account are rejected with 403 account_suspended.
  • Revoked or rotated-out keys stop working within seconds and return 401 unauthorized.
  • Lost your authenticator and recovery codes? Contact support for help.

Keep your API key secret. Do not expose it in client-side code or public repositories.

Section 03

Base URL

https://api.skinscave.com

All public-API paths are prefixed with /v2. Every route lives under /v2/account/* - there is no public, unauthenticated marketplace data in this API.

Section 04

What you can access

The public API is scoped entirely to authenticated /v2/account/* endpoints for your own listings and transaction history. There are no public marketplace-data reads, and no endpoint exposes another user's private data.

You can:

  • Create, fetch, edit, and delist your own active listings
  • List your own transactions
  • Fetch one of your transactions by ID

You can't:

  • Read public marketplace listings or sale history
  • Read or refresh your Steam inventory
  • Buy, bid, read active trades, or move funds
  • Read another account's data, ever
  • Read your live balance
  • Send messages or change account settings

Section 05

Managing keys

  • One active key per account. If you need to replace your key, use Rotate - the old key is revoked instantly and a new one is issued in the same call.
  • Step-up required. Creating, rotating, and revoking a key are all step-up actions. With 2FA, you'll be prompted for a 6-digit authenticator code (5 failures locks for 15 min - the same lockout also applies to emailed one-time codes). Without 2FA, a fresh code is emailed for each action. Listing your existing keys never requires step-up. Lost your authenticator and recovery codes? Contact support.
  • Shown once. The plaintext key is returned only at creation or rotation. We store a SHA-256 hash - we cannot recover a lost key. Store it in a password manager or environment variable. Never in client-side code or a public repository.
  • Revoking is permanent. Any request using a revoked or restricted key returns 401 unauthorized within seconds.
  • Rate limited. Create, rotate, and revoke are each capped at 5 attempts per minute to stop a compromised session from spamming verification emails or hammering your key. See 429 rate_limited below.

Section 06

Error Responses

All errors return JSON with error and code fields.

{
  "error": "Invalid or missing API key",
  "code": "unauthorized"
}

// Common HTTP status codes:
// 400 bad_request                  - Missing or invalid parameters
// 401 unauthorized                 - Invalid, missing, revoked, or restricted API key
// 403 account_suspended            - The key holder's account is suspended
// 403 two_factor_required          - Step-up: include "code" or "recovery_code"
// 403 email_required               - Step-up: account has no email set
// 403 email_verification_required  - Step-up: email is set but not verified
// 403 email_code_required          - Step-up: emailed one-time code has been sent
// 422 email_code_invalid           - Step-up: emailed one-time code is invalid or expired
// 503 email_code_delivery_failed   - Step-up: verification email could not be sent
// 404 not_found                    - Resource not found, or not yours
// 422 two_factor_invalid           - Wrong code; try again
// 429 rate_limited                 - Too many requests (see Retry-After)
// 429 two_factor_locked            - 5 failed codes; locked 15 minutes
// 500 internal_error               - Server error

Section 07

Endpoints

GET/v2/account/listings
List the authenticated key holder's own active listings.

Parameters

per_pageintegerItems per page (default: 50, max: 100)

Example

curl -H "Authorization: Bearer sc_your_key_here" \
  "https://api.skinscave.com/v2/account/listings"

Response

{
  "listings": [ { "listing_id": 12345, "asset_id": "123456", "price": 4999, "status": "listed", "listing_visibility": "public" } ],
  "pagination": { "page": 1, "per_page": 50, "total": 1, "total_pages": 1, "has_next": false, "has_prev": false }
}
GET/v2/account/listings/:listing_id
Fetch one owned active listing.

Example

curl -H "Authorization: Bearer sc_your_key_here" \
  "https://api.skinscave.com/v2/account/listings/12345"

Response

{ "listing": { "listing_id": 12345, "asset_id": "123456", "price": 4999, "status": "listed" } }
POST/v2/account/listings
Create one listing. Supports normal and auction listings.

Parameters

asset_idstringSteam asset id to list
priceintegerPrice in cents
listing_typestringnormal or auction
visibilitystringpublic or private
allow_offersbooleanWhether offers are allowed (default: true)
min_offerintegerMinimum offer in cents
auction_durationintegerRequired for auctions: 1, 3, or 7 days

Example

curl -X POST \
  -H "Authorization: Bearer sc_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"asset_id":"123456","price":4999,"listing_type":"normal","visibility":"public"}' \
  "https://api.skinscave.com/v2/account/listings"

Response

{ "listing": { "listing_id": 12345, "asset_id": "123456", "price": 4999, "status": "listed" } }
PATCH/v2/account/listings/:listing_id
Update a listing's price, offer settings, or visibility.

Parameters

priceintegerPrice in cents
allow_offersbooleanWhether offers are allowed
min_offerintegerMinimum offer in cents
listing_visibilitystringpublic or private

Example

curl -X PATCH \
  -H "Authorization: Bearer sc_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"price":4749,"allow_offers":true,"min_offer":4500}' \
  "https://api.skinscave.com/v2/account/listings/12345"

Response

{ "listing": { "listing_id": 12345, "price": 4749, "allow_offers": true, "min_offer": 4500 } }
DELETE/v2/account/listings/:listing_id
Delist one owned active listing.

Example

curl -X DELETE -H "Authorization: Bearer sc_your_key_here" \
  "https://api.skinscave.com/v2/account/listings/12345"

Response

{ "listing": { "listing_id": 12345, "status": "delisted" } }
GET/v2/account/transactions
List the key holder's own transactions.

Parameters

pageintegerPage number (default: 1, max: 1000)
per_pageintegerItems per page (default: 50, max: 100)
typestringFilter: sale | purchase | deposit | withdrawal | fine | fine_reversal | fine_revenue_share
sincestringISO-8601 lower bound on created_at (inclusive)
untilstringISO-8601 upper bound on created_at (inclusive)

Example

curl -H "Authorization: Bearer sc_your_key_here" \
  "https://api.skinscave.com/v2/account/transactions?type=sale&since=2026-01-01T00:00:00Z"

Response

{
  "transactions": [
    {
      "transaction_id": "TXN-001234",
      "type": "sale",
      "status": "completed",
      "total_amount": 4999,
      "net_amount": 4749,
      "fee_amount": 250,
      "fee_percentage": 5.0,
      "description": "Sale of AK-47 | Redline (Field-Tested)",
      "created_at": "2026-03-14T12:00:00Z",
      "completed_at": "2026-03-14T12:05:00Z",
      "refunded": false,
      "items": [ { "listing_id": 12345, "price": 4999, "item": { "market_hash_name": "AK-47 | Redline (Field-Tested)", … } } ]
    }
  ],
  "pagination": { "page": 1, "per_page": 50, "total": 87, "total_pages": 2, "has_next": true, "has_prev": false }
}
GET/v2/account/transactions/:transaction_id
Fetch a single transaction. Accepts numeric id or TXN-000123 display form.

Example

curl -H "Authorization: Bearer sc_your_key_here" \
  "https://api.skinscave.com/v2/account/transactions/TXN-001234"

Response

{
  "transaction": {
    "transaction_id": "TXN-001234",
    "type": "sale",
    "status": "completed",
    "total_amount": 4999,
    "net_amount": 4749,
    "fee_amount": 250,
    "fee_percentage": 5.0,
    "items": [ { … } ]
  }
}

Section 08

Rate Limits

Each endpoint group has its own hourly budget - listings and transactions are tracked independently, each capped at 30 requests/hour. The budget resets on the wall-clock hour (UTC) and is tied to your account, so rotating your key does not reset it. Exceeding it returns 429 rate_limited with a Retry-After header (seconds).

Creating, rotating, and revoking keys (on /api/api-keys, not /v2) are separately capped at 5 attempts per minute each.

Every response includes the current state in headers - including successful 2xx responses - so you can pace yourself without hitting the wall:

X-RateLimit-Limit:     30          # your budget for this endpoint group
X-RateLimit-Remaining: 24          # requests left in this window
X-RateLimit-Reset:     1773532800  # unix timestamp when the window resets
X-RateLimit-Window:    3600        # window length in seconds
HTTP/1.1 429 Too Many Requests
Retry-After: 1800
X-RateLimit-Limit: 30
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1773532800
X-RateLimit-Window: 3600

{
  "error": "Rate limit exceeded",
  "code": "rate_limited",
  "message": "Too many requests. Limit: 30 requests per 60 minutes",
  "retry_after": 1800
}