Account requirements

Four things about your Steam account decide whether you can use LootFi at all: your inventory privacy, your trade URL, your mobile authenticator, and whether your account is allowed to trade. This page covers each, plus the item-level restrictions that make some skins permanently untradeable.

LootFi never asks for these

Nobody from LootFi — on the site, on Discord, by email, or anywhere else — will ever ask you for:

• your Steam password
• your Steam Guard mobile authenticator codes, recovery codes, or maFile / shared-secret / identity-secret values
• your Steam Web API key
• your wallet seed phrase, private key, or recovery words

Any request for one of these is an attempt to steal your account or your wallet, no matter how convincing it looks or who it appears to come from. LootFi needs your public inventory, your trade URL, and a wallet signature. Nothing else.

Public inventory

Your CS2 inventory is read over Steam's public interface. If it is set to Private or Friends Only, the read returns nothing — and an inventory that is hidden is indistinguishable from an inventory that is empty.

To make it public:

  Steam  ->  your Profile  ->  Edit Profile
         ->  Privacy Settings
         ->  Inventory  ->  Public

If the site shows you an empty inventory while Steam shows items, this is the first thing to check. Steam's own caches also take a few minutes to reflect a privacy change, so re-check after a short wait before assuming something is broken.

Trade URL

Your trade URL is how the custody account sends you a trade offer — both the deposit request and, later, the offer returning your skin. It looks like this:

https://steamcommunity.com/tradeoffer/new/?partner=<digits>&token=<token>

Two parts matter. partner identifies your account, and token is a secret that authorises strangers to send you offers. Both must be present; a URL missing the token parameter will be rejected.

Where to find it:

  Steam  ->  Inventory  ->  Trade Offers
         ->  "Who can send me Trade Offers?"
         ->  Third-Party Sites  ->  copy the full URL

Regenerating your token breaks pending withdrawals

The same screen has a button that generates a new trade URL. Using it immediately invalidates the old one. Any withdrawal offer that has not been sent yet cannot be delivered to a dead URL, and a delivery that fails will keep failing until the stored URL is fixed.

If you regenerate your token — deliberately or as part of a security cleanup — save the new trade URL on LootFi straight away. Your item stays in custody the whole time; it simply cannot be handed back until there is a valid address to hand it to.

Save the URL exactly as Steam gives it to you, with no trailing characters and no URL-shortener in between.

Mobile authenticator

Steam Guard's mobile authenticator must be active on your account, and it should have been active for more than 7 days before you deposit.

• No authenticator — Steam holds your trades, so a deposit takes up to 15 days instead of about 7.
• Authenticator added or moved to a new device in the last 7 days — Steam applies a 15-day hold to your trades. Replacing a phone shortly before depositing is the single most common cause of an unexpectedly long wait.
• Authenticator settled for more than 7 days — no additional hold from this source.

The mechanics, and why the hold cannot be shortened, are in Escrow & holds.

Accounts that cannot trade

Some accounts cannot trade at all. While any of these applies, no deposit and no withdrawal can complete — the trade offer will not go through, and there is nothing LootFi can do about it from this side.

Restriction	Effect	Typical duration
Trade ban	Steam blocks all trading on the account.	Set by Steam; can be permanent.
VAC-related restrictions	Trading and market access can be limited following a VAC ban.	Often permanent for the affected items.
Community ban	Trading, the Market, and community features are blocked.	Set by Steam.
Recent password change	Steam temporarily locks trading and the Market.	Several days.
Recent email address change	Same lock as a password change.	Several days.
Steam Guard removed or reset	Trading restricted until Steam Guard is settled again.	Up to 15 days.
Family View enabled	Trading is blocked while Family View is on for the account.	Until disabled.

Steam shows most restrictions publicly on your profile. If a deposit offer never arrives or is rejected the moment it is sent, check your account status before anything else.

Region and market restrictions

Some items are untradeable for reasons attached to the item, not to your account:

• Items received from a restricted region. Steam applies trade restrictions based on where an item was acquired; those restrictions can be permanent.
• Items still inside their post-purchase cooldown. Newly bought or newly opened items carry Steam's own tradability delay.
• Items that are marketable but not tradable, or neither. Steam marks these explicitly on the item.
• Souvenir, promotional, and event items with trading disabled by Valve.

The deposit picker only offers items Steam reports as tradable, so a restricted item simply will not appear as depositable. That is Steam's answer about the item, not a judgement LootFi is making. See What you can deposit.

A permanently untradeable item can never be deposited

If Steam has permanently restricted an item, no protocol can move it. There is no workaround, and any service claiming otherwise is either lying or asking for your account credentials.

Quick self-check

Before your first deposit, confirm all five:

1. Inventory privacy is Public.
2. Trade URL is saved on LootFi, copied fresh from Steam, with a token parameter.
3. Mobile authenticator has been active for more than 7 days.
4. No trade ban, community ban, or recent password/email change lock.
5. The specific item you want to deposit shows as tradable in Steam.

If all five hold, your deposit will follow the ordinary path in Deposit a skin.

Related

• Steam rules & limits — every restriction on one page
• Escrow & holds — why a hold gets applied
• Withdraw your skin — where the trade URL is used again
• Troubleshooting — symptoms and their causes