The Steam Web API for CS2, step by step.

Sign in at steamcommunity.com/dev/apikey with a Steam account in good standing, enter a domain name, and Steam issues a 32-character key. Keep it on a server: Valve's terms require it to stay confidential, and Steam sends no CORS headers, so browsers cannot call the API anyway.

Three things: their 64-bit Steam ID, a game authentication code they create in Steam's help pages for CS2 match history, and the share code of one match they already played. Without the authentication code Steam will not hand out their match codes.

• Steam ID (64-bit), for example 76561197960287930.
• Game authentication code, format AAAA-AAAAA-AAAA. Treat it like a password.
• A known share code, format CSGO-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx, copied from the in-game match history.

Call ICSGOPlayers_730/GetNextMatchSharingCode with the known code. It returns the next code; call again with that one, and stop when it returns "n/a". Store the last code you saw, so the next run starts from there instead of from the beginning.

import json, pathlib, requests

STEAM_KEY = "YOUR_STEAM_WEB_API_KEY"
URL = "https://api.steampowered.com/ICSGOPlayers_730/GetNextMatchSharingCode/v1/"
STATE = pathlib.Path("last_code.json")

def new_share_codes(steamid: str, auth_code: str, first_known: str) -> list[str]:
    code = json.loads(STATE.read_text())["code"] if STATE.exists() else first_known
    found = []
    while True:
        r = requests.get(URL, params={"key": STEAM_KEY, "steamid": steamid,
                                      "steamidkey": auth_code, "knowncode": code}, timeout=10)
        if r.status_code == 202:              # some clients see this for "nothing newer yet"
            break
        r.raise_for_status()                  # 403: check the key and the auth code
        nxt = r.json()["result"]["nextcode"]
        if nxt == "n/a":
            break
        found.append(nxt)
        code = nxt
    STATE.write_text(json.dumps({"code": code}))
    return found

print(new_share_codes("7656119...", "AAAA-AAAAA-AAAA", "CSGO-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx"))

Decode it: the 25 characters after CSGO- are a base-57 number that holds the match ID, the reservation ID and the TV port. The share code decode page has tested Python and JavaScript decoders and the five mistakes that break them.

Right there. No Steam Web API method returns the scoreboard for a match ID: kills, rounds and ratings come from downloading the replay demo through a Steam client library and parsing it. And professional matches are not in Steam at all, so none of this works for esports.

For professional CS2 it replaces the whole chain: no auth codes, share codes, demos or parsers. One key, one request per job, and the stats are already per map.

import os, requests

H = {"x-api-key": os.environ["CITO_API_KEY"]}
match = requests.get("https://api.citoapi.com/api/v1/cs2/matches/results", params={"limit": 1}, headers=H).json()["data"][0]
lines = requests.get(f"https://api.citoapi.com/api/v1/cs2/matches/{match['id']}/player-stats", headers=H).json()["data"]
for p in lines:
    print(p["playerName"], p["kills"], p["deaths"], p["adr"], p["rating"])