Trade-Link and API Scams to Avoid
What trade links and API keys do
Your trade URL is a shareable link that lets someone send you a trade offer. Your Steam Web API key is a credential that lets applications read and act on your account's Steam data. Both are legitimate, but both can be abused.
Sharing a trade URL is normal; exposing or mishandling an API key is where serious trouble starts.
Why a stolen API key is dangerous
If a scammer obtains or plants an API key tied to your session, they can monitor your trades and, in some setups, cancel a genuine offer and replace it with a malicious one at the moment you confirm. You think you are accepting the trade you set up, but you confirm a different one.
This is why you should never paste your API key into a third-party site or run tools that ask for it.
Common trade-link scams
Typical tricks include impersonating a buyer or a marketplace bot, sending an offer that looks right but has been swapped, or linking to a fake marketplace that harvests your credentials. Fake middlemen who offer to hold items are another recurring theme.
Protecting yourself
Keep the Steam Guard Mobile Authenticator active so every trade needs confirmation, and read each confirmation carefully: check the exact items and the recipient before approving. Revoke your API key if you ever suspect it has leaked, and never share it.
When in doubt, cancel and restart the trade yourself rather than accepting an incoming offer.
Frequently Asked Questions
What is a Steam Web API key used for?
It lets applications read and act on your Steam account data. It is useful for legitimate tools but dangerous if a scammer gains access to it.
How do API scams actually steal items?
A scammer with access can intercept a genuine trade and substitute a malicious one, so the offer you confirm is not the one you set up. Reading each confirmation carefully defends against this.
Is it safe to share my trade URL?
Sharing the trade URL itself is normal and necessary to receive offers. The risk comes from fake offers, so always verify items and recipients before confirming.
Should I ever paste my API key into a website?
No. No legitimate service needs you to paste your Steam Web API key. Treat any request to do so as a scam and revoke the key if you already have.
How do I undo a leaked API key?
Revoke or regenerate it in your Steam settings, change your password, and keep the mobile authenticator active. Then review recent trades for anything you did not authorise.