Sign in

Your logins never leave your computer.

Your bot runs on your own computer and keeps your Steam login there. Our server never sees it.

How it works.

  1. 01

    You set up the bot on your computer

    You enter your Steam login and CSGORoll cookie in the setup window. They're saved on your computer, locked to your Windows user.

  2. 02

    Your bot trades from there

    It connects to Steam and CSGORoll straight from your computer.

  3. 03

    Our server only talks to your bot

    Your dashboard sends simple requests, like list or hold a skin. The bot sends back your trades, items and balances, never your logins.

What stays with you, and what we see.

Stays on your computer

Never sent to us

  • Your Steam password
  • Your Steam authenticator (maFile)
  • Your CSGORoll cookie
  • Your bot's own key

One exception: a new CSGORoll cookie you paste into your dashboard passes through our server to your bot. We don't keep it. This only works if you allow it in Settings.

What we see

What your dashboard needs

  • Your trades and items
  • Your listings and their prices
  • Your balances and total worth
  • Which accounts are yours

What our server can ask your bot.

It can ask your bot to

The full list is in the fine print below

  • List, reprice, hold or release your skins
  • Follow the selling and buying rules you set
  • Send skins to the main Steam account in your Settings
  • Refresh CSGORoll's Steam token when you press Refresh Steam token

It can never

Even if someone takes over our server

  • Move your coins anywhere
  • Get your Steam password or authenticator
  • Make your bot accept a trade it wouldn't accept on its own
  • Make your bot run a version we didn't sign

Locked down on our side too.

  • Signed updates

    Every version of the bot is signed with a key we keep off our server. Your bot refuses anything else.

  • A key for every bot

    Each bot proves who it is with its own key, made on your computer. Our server only holds the public half.

  • Two-step login

    Every login needs a code from your authenticator app, so a stolen password isn't enough.

The fine print.

Every detail, for those who want it.

Everything our server can ask your bot, and the limits
Our server can ask your bot for
  • Your listing rules: the markups and price drops you set in your dashboardNever below an item's CSGORoll value or above the highest markup CSGORoll allows. At most 240 listing changes an hour.
  • Which rare skins to hold back: our rules for blue gems, fades, Fire & Ice and low floats, plus your changes in SettingsIt never lists a skin or changes a price. It can only hold a skin, or take down a listing no buyer has joined yet and hold it. This counts toward the same 240 changes an hour.
  • A command for one item: list it now, set or reset its own markup, hold it, release it, or take it down and hold itNever above the highest markup CSGORoll allows. An item's own markup can be below its CSGORoll value, down to 0.01 coins. This counts toward the same 240 changes an hour.
  • To send skins to the main Steam account in your Settings, in one trade offer that asks for nothing backOnly to that account. You add or change it in Settings with your password and an authenticator code. It's saved on our server, so your bot can't limit where a skin goes. Someone who broke into our server could put their own account there.
  • A new CSGORoll cookie you paste into your dashboardOnly passed on if you allow cookie replacing in Settings. Your bot checks it once with CSGORoll and only uses it if it belongs to your account. At most six tries an hour. It never logs your account in or out.
  • To give CSGORoll a fresh Steam token now, when you press Refresh Steam tokenIt carries no token, only the account. Your bot uses its own Steam login, and only refreshes when it would anyway: when token refresh is switched on at your computer and selling isn't off. At most three an hour. It never logs your account in or out.
  • A version of the bot to runOnly one we signed and haven't withdrawn. Our server can name a version, but it can't make one.
  • Its own listing records, if your bot starts without them, for example on a new computerThe same limits as rules and commands.
  • To stop new listings while a bill is unpaid, or while we have restricted your accountIt carries no item, amount or markup. Listings already up stay up, and a sale in progress finishes. It ends by itself after 48 hours unless our server confirms it.
  • Which of your CSGORoll purchases to leave unaccepted, by the buying rules you set in Settings: a Buff163 price limit, a CSFloat price limit and a blacklistIt can only leave a delivery open. Your bot never declines, counters or confirms one, and the seller is expected to cancel it and return your coins. It never makes your bot accept an offer it wouldn't accept on its own. A limit is 50% to 200% of the market price, and the blacklist holds at most 2,000 names. Rules outside that are refused.
  • Buff163 and CSFloat prices for the skins on the account. A skin CSGORoll values well below them waits for a better CSGORoll price before its first listing. Rare skin estimates start from them. With selling fast turned on, a skin CSGORoll values far above them in a falling market is sold fastIt never prices a skin, moves it or releases your holds. A skin only waits before its first listing, for no longer than the longest wait in your rules, and never more than 30 days. Rare skin estimates can go up or down, so more or fewer rare skins are held. With Sell overpriced items fast on in your Settings, a skin over the line you set in a falling market is listed, or relisted lower, at your fast markup. Never below its CSGORoll value, and never a skin with its own markup, one on hold or one a buyer has joined.
It can never
  • Move your coins anywhere, or an item anywhere but the main Steam account in your Settings
  • Turn selling on, turn incoming offers or the Steam token refresh on or off, or make your bot accept an offer it wouldn't accept on its own
  • List an item above the highest markup CSGORoll allows, or for nothing
  • Make your bot change more than 240 listings an hour, try more than six cookies an hour, or refresh its Steam token more than three times an hour
  • Make your bot use a CSGORoll cookie that isn't your account's
  • Make your bot run a program we didn't sign
  • Get your Steam password, your authenticator secrets or your bot's own key
  • Pose as your bot
If someone breaks into our server

We plan for it. Here's what they could try, and what they'd get.

Read your data
Every trade, item, balance and rule we hold. Any online dashboard has this risk, so we keep no more than we show you. They could also show you false numbers.
Get your Steam password or authenticator secrets
Nothing. They're not on our server, and your bot only runs versions signed with a key our server never holds.
Get your CSGORoll cookie
Your bot never sends it. A cookie you paste into your dashboard while they control our server could be read on its way to your bot. They could also turn cookie replacing on and send your bot their own cookies. It tries six an hour at most, checks each once with CSGORoll, and only uses one that belongs to your account.
Pretend to be your bot
That takes your bot's own key, which only exists on your computer. Our server only keeps the public half.
Change what your bots do
Only what's on the list above. They could change rules, lift holds, take listings down, and list any item, even a held one, below its CSGORoll value, down to 0.01 coins, so they could buy it cheap. At most 240 listing changes an hour per account. They could also have your bots refresh CSGORoll's Steam token, at most three times an hour, and leave all your purchases unaccepted so the sellers cancel them. No coins move. An item only leaves through a normal CSGORoll sale, paid into your own balance, or by a send (next line).
Send your skins to an account of theirs
They could set their own Steam account as your main Steam account, without a code, and have your bots send it every skin they can trade. Your bot can't stop that, because the main Steam account is saved on our server.
Stop your bots
They can stop your bots' new work while they control our server. Once we have it back, your bots reconnect within about an hour. If they told a bot its computer was removed, it waits until you restart it there.
Flood your bot with messages
That can crash the bot, again each time it restarts. Nothing moves and nothing leaks, and the bot picks up where it left off. A sale in progress waits while the bot is down.
Send your bot another version
Only one we signed. A version we withdrew can still reach a bot they keep the news from, for up to 30 days.
Redirect a payment
They could show you their own payment page, so a fee you pay goes to them. Your items and coins aren't involved.

A stolen dashboard password alone isn't enough, because every login needs two-step login. If the thief also has your authenticator or recovery codes, they get your dashboard, but never your logins. They could do what's on the list above, list your items below their CSGORoll value, turn cookie replacing on, and set their own Steam account as your main one to receive your skins. We email you at every new sign-in, so you can catch it early.

What we can't promise

  • The bot is our program, and it runs with your logins.

    A signature proves a version came from us, not that it's harmless. Every version is built on GitHub's own servers from reviewed code, and signed with a key that needs a person to use it.

  • We see your trading.

    Your trades, items, balances and which accounts are yours are on our server. A leak would show them, but not your logins.

  • Keeping your computer safe is up to you.

    The bot encrypts what it saves, so a copied file won't work elsewhere. It can't stop someone who is signed in to Windows as you.

  • CSGORoll and Steam make their own rules.

    We can't promise an account will never be limited or closed.