How do sites like CDKeys get their keys?

Question

This question has been answered on Reddit and Quora, but not with the rigor that Stack Exchange sites demand, so I thought I would ask it here (where it doesn't seem to have been asked yet).

Answer 1

I believe "CDKeys (and other key sites)" is too broad to cover in an answer, so to narrow the scope a bit, let's focus specifically on gray-market key resellers—companies that sell game keys without authorization from publishers. This includes sites like CDKeys and G2A.

Gray-market key resellers operate differently from authorized retailers. While authorized sellers obtain their keys directly from game publishers, these unauthorized resellers typically acquire their keys through alternative means. They often purchase codes from regions where games are sold at lower prices or buy from third-party sellers. When you make a gray market purchase, you typically won't know the original source of your key, making each transaction essentially a blind purchase. Thus, caveat emptor ("let the buyer beware") applies.

The murky nature of unauthorized resellers means keys could potentially come from illegal sources, including theft or fraud. In many cases, game developers and publishers receive minimal compensation - or none at all - from these sales. For instance, Mike Rose, founder of indie publisher No More Robots, has stated that developers don't receive any revenue from gray market sales of their games.

The /r/GameDeals subreddit warns users about these sellers, noting that keys may have region locks or even be retroactively removed from user accounts. As the /r/Steam wiki explains, even receiving a working key doesn't necessarily validate the reseller - it's comparable to surviving a round of Russian Roulette and declaring the game "safe."

There have been numerous documented incidents of problems with gray market keys:

• Ubisoft deactivated unauthorized copies of Far Cry 4
• Over 7,000 stolen Sniper Elite 3 keys were revoked
• 1,341 Natural Selection 2 keys were stolen, costing the developer $30,000 in fees
• 30,000 The Blackwell Deception keys were revoked after a giveaway exploit
• Devolver Digital actively cancels games purchased through unauthorized resellers

The impact on indie developers has been particularly severe. Wube Software, developers of Factorio, has detailed how fraud and gray-market resales directly harm smaller studios. Some developers, including RageSquid and No Goblin, have even stated they'd prefer players pirate their games rather than purchase from unauthorized resellers, as at least then the resellers don't profit from the transaction.

In one notable resolution, G2A paid Wube Software, Factorio developer, $39,600 in compensation for illegally obtained Factorio keys sold through their marketplace.

To ensure you're purchasing from legitimate sources, use the /r/GameDeals Store Checker or IsThereAnyDeal to find authorized key sellers. When in doubt, contact the game developer or publisher directly to verify a retailer's authenticity.

For further reading check out: Key Resellers and What They Mean for You (/r/Steam wiki).

Answer 2

The usual correct way to get keys is for Developers to generate them off Steam or their platform of choice. These are then sold to other stores in bulk or in exchange for a commission (usually a discount off the list price).

However, sometimes these keys get redistributed or stolen outside of a store or developer's control for reasons like:

• a store getting hacked
• the developer was socially engineered
• a user not needing the key anymore and thus resold it

Keys unfortunately are ready to use as they do not have an activation mechanism like gift cards, making them lucrative for cybercriminals.

Since this question is about Steam, see this for more details.