We never ask for your password or API key
skin1 uses Steam sign-in only. Anyone asking for your password, mobile authenticator code, or full API key is trying to steal your inventory.
Clone domains
Always check you're on the real skin1 domain. Scammers register look-alike domains and fake Steam login pop-ups. Bookmark the real site.
Enable 2FA
Two-factor authentication on both Steam and skin1 stops the vast majority of account takeovers. We require it for selling.