Embed parameters
Every option the embed reads, whether you set it through CS2Embed.mount()
or by hand on the /embed URL. The bounds below are enforced by the frame itself. An
out-of-range or malformed value is dropped silently and the default is used instead: nothing you
pass on this surface can produce a 400.
The one required input
Pass either inspect or s. Nothing else is required.
inspect: a Steam inspect link, the same string CS2's own UI and the Steam Market expose. Decoded client-side into an item, condition, pattern, stickers, charm and StatTrak count. Most integrators should use this.s: the viewer's own catalog id, paired with the studio's own share params (wear,seed,st,name). Useful if you're already working from this site's own catalog rather than a live inspect link.
If you pass both, inspect wins. s, wear,
seed and st are ignored, and the inspect link's own float, pattern,
stickers, charm and StatTrak count are used instead.
Item and condition
| Param | Type / bounds | Default | Notes |
|---|---|---|---|
| inspect | Steam inspect link, any length | n/a | Decoded client-side. Carries wear, seed and stickers with it: see above. |
| s | /^[a-z0-9][a-z0-9_.-]*$/i | n/a | A catalog id. Unrecognised ids fail to load (see fallback codes). |
| wear | number, 0-1 | kit default | Float value. Out-of-range or non-numeric is dropped, not clamped. |
| seed | integer, 0-100000 | kit default | Pattern seed. |
| st | slot:stickerId:wear[,…], up to 5 | none | Each entry: slot (1-2 digits), stickerId (1-6 digits),
wear (one digit, optional up to 4 decimals). Malformed strings are dropped
whole (falls back to no stickers). |
| name | ≤20 printable characters, no control characters | none | A StatTrak-style nametag. Trimmed; over-length or containing a control character is dropped whole. |
Scene, view and chrome
| Param | Type / bounds | Default | Notes |
|---|---|---|---|
| scene | /^[a-z0-9_]{1,64}$/i | scene bg default |
A backdrop id, e.g. plate_train_video. An id that doesn't match a known
backdrop degrades to the studio's own default rather than failing. |
| view | front | back | hero |
front | Camera framing on boot. |
| autorotate | 1/true to enable | off | Always off under the visitor's prefers-reduced-motion, regardless of this
param. Stops for good on the visitor's first pointer-down. |
| bg | scene | black | scene |
Whether the backdrop plate renders or the frame is a flat black background. |
| ui | minimal | none | minimal |
See UI and the wordmark below. none
does not always remove the attribution mark. |
| theme | dark | light | dark |
The chrome only (name plate, wordmark). The render itself is the render. |
Identity and access
| Param | Type / bounds | Default | Notes |
|---|---|---|---|
| key | /^[a-z0-9_-]{4,64}$/i | none (anonymous) | Your publishable key. It's meant to be published: it rides in the iframe's
src, in your page source. Security comes from the origin allowlist you
register in the dashboard, not from keeping the key secret. |
| origin | an http(s) origin | the page's referrer, if any | The host page's own origin, for targeting postMessage traffic. CS2Embed.mount()
sets this for you automatically. Set it yourself if you hand-build the iframe: see
postMessage API. |
UI and the wordmark
ui=minimal (the default) shows a small item name plate and the corner attribution
wordmark. ui=none hides the name plate, but the wordmark is a request, not a right:
it only disappears when your key's plan allows removing it (Pro and Enterprise).
On Free and Starter it stays regardless of ui. That's the Free and Starter tiers'
attribution requirement, and the server enforces it from the plan it injects into the page when it
serves /embed, not from a query parameter a page could omit. See
Pricing for which plans include wordmark removal.
The loader: CS2Embed.mount(el, options)
Everything above, as an options object, plus two loader-only fields:
| Option | Type | Default | Notes |
|---|---|---|---|
| title | string | "3D skin viewer" |
The iframe's accessible title attribute. |
| lazy | boolean | true |
Pass false to load eagerly (loading="eager") instead of the
browser's native lazy loading. |
var viewer = CS2Embed.mount(document.getElementById('viewer'), {
inspect: 'steam://rungame/730/76561202255233023/+csgo_econ_action_preview 0018...',
scene: 'plate_train_video',
view: 'front',
autorotate: true,
bg: 'scene',
ui: 'minimal',
theme: 'dark',
key: 'cs2pk_your_key_here',
title: 'AK-47 | Redline in 3D',
lazy: false,
});The handle it returns has methods for everything you'd otherwise pass as a param up front:
setItem, setScene, setView, setAutorotate,
setQuality, resetView, screenshot, destroy, plus
on/off for events. See postMessage API for
the full command and event list, and Frameworks for React/Vue
wrappers around it.
Without a script tag: the raw /embed URL
If you won't add a script tag, build the iframe by hand. Every param above is a query parameter on
GET /embed:
<iframe
src="https://inspekt.gg/embed?inspect=steam%3A%2F%2Frungame%2F730%2F76561202255233023%2F%2Bcsgo_econ_action_preview%2000180720...&scene=plate_train_video&autorotate=1&origin=https%3A%2F%2Fyoursite.example"
style="width:640px;height:400px;border:0"
loading="lazy"
allow="autoplay; fullscreen"
referrerpolicy="strict-origin"
title="3D skin viewer"
></iframe>Set origin yourself on a hand-built iframe. Without it, the frame falls back to
your page's document.referrer (which some browsers withhold), and with neither,
outbound postMessage traffic is addressed to * instead of your page specifically.
The loader script sets this for you automatically, which is one more reason to prefer it over a
raw iframe when you can.
Access control
Whether the frame is allowed to paint at all is enforced twice: by our server, and, for a key with
registered origins, by the browser itself, through a
Content-Security-Policy: frame-ancestors header scoped to that key's origins. A key
lifted from one customer's page source and pasted into a different site is refused by the visitor's
own browser, before any of our code runs. Register and manage your origins in the
dashboard; see Error codes for what a refusal
looks like from inside the frame.