We use Valve's official OpenID login — we never see your Steam password. After sign-in, our server uses the app's Steam Web API key (configured by the site) to load your public profile; you do not need to paste your own API key anywhere.