Steam Trade URL and API Key: How to Find Them Safely

On this page ▾

1. What is a Steam trade URL?
2. How to find your trade URL
3. What is a Steam API key?
4. How to get your API key
5. The API key scam, explained
6. If you think your key is compromised
7. How to read a trade offer before you accept
8. Trade protection and why it matters here
9. Best-practice setup for Canadian players
10. Using your trade URL on gambling sites

Two pieces of Steam data come up constantly when you use skin sites: the trade URL and the API key. They sound similar, but they have very different risk profiles. Mixing them up is one of the most common ways Canadians lose inventories. This guide shows you where to find each one, how to use them, and how to protect yourself.

What is a Steam trade URL?

A trade URL is a personal link that lets someone send you a trade offer without being on your friends list. It contains your partner ID and a private token. Skin sites need it so their bots can send items you have withdrawn, and so you can start deposits. The link by itself cannot move items out of your inventory. Anything leaving your account still requires you to accept the offer and confirm it in the Steam Mobile Authenticator.

How to find your trade URL

1. Log in to Steam in a browser or the desktop client.
2. Open your Inventory from your profile menu.
3. Click Trade Offers.
4. Choose "Who can send me trade offers?" on the right side.
5. Scroll to the Third-Party Sites section. Your Trade URL is displayed.
6. Click Copy and paste it into the skin site's settings page.

Tip: If you create a new trade token, the old URL stops working. Update every site where you saved the old link.

Trade URL problems

Live demo

Steam Market Fee Calculator

Full page & guide →

ModeI want to receive…Buyer pays…

Amount (CA$)

Steam Community Market: 5% Steam transaction fee + 10% Counter-Strike 2 game fee, each rounded down with a CA$0.01 minimum. Steam Wallet funds can't be withdrawn as cash.

What is a Steam API key?

The Steam Web API key is a developer credential tied to your account. Developers use it to read data such as inventory contents and trade offers. Some third-party tools ask for it to monitor your offers automatically, and a few skin sites request it to detect cancelled or modified trades.

The key is powerful because someone who has it can read your trade offers in real time. In the wrong hands, it can be used to intercept and replace an offer you are about to receive.

How to get your API key

1. Make sure your Steam account is not limited. Steam generally requires that you have spent at least US$5 on the platform.
2. Visit steamcommunity.com/dev/apikey while logged in. Type the address yourself; do not click a link from a chat.
3. Enter a domain name when prompted. Use the exact domain requested by the legitimate tool you trust; for personal use some players enter a placeholder.
4. Agree to the Steam Web API terms and click Register.
5. Copy the key only into the specific tool that needs it.

The API key scam, explained

This scam is common enough that you should know how it works. The attacker convinces you to submit your API key, perhaps via a fake site, a "free skins" bot or a Discord message. They then watch your account for trade offers. When you create a legitimate offer to a friend or a site, they instantly cancel it and send a near-identical offer from a lookalike account, often with the same name and profile picture. If you accept without checking, your items go to the thief.

Red flags

• A stranger offers free skins, a giveaway or a better deposit rate for your key.
• A site asks you to log in with a username and password instead of "Sign in through Steam".
• You receive an offer before you started a deposit or withdrawal.
• The bot's name or profile level does not match what you saw earlier.

If you think your key is compromised

1. Revoke the key on steamcommunity.com/dev/apikey straight away.
2. Change your Steam password and review your Steam Guard devices.
3. Cancel pending trade offers in the Trade Offers page.
4. Sign out of other sessions from Steam account settings.
5. Check your email for unfamiliar notifications and secure that account too.
6. Contact Steam Support if items were stolen, though recovery is not guaranteed.

How to read a trade offer before you accept

1. Check who sent it. Open the sender's profile and compare the name, level, join date and Steam ID with the bot you saw on the site.
2. Check the direction. The offer should show items under "You will give" for a deposit and under "You will receive" for a withdrawal.
3. Check each item. Match name, wear, StatTrak status and stickers against what you chose. Scammers sometimes swap a similar but cheaper item.
4. Read the message. Ignore anything urging you to hurry or to type a code into a website.
5. Confirm in the app. The mobile confirmation screen shows the items again; check them once more before approving.

This takes about thirty seconds and defeats the large majority of offer-swapping tricks, including those that rely on a stolen API key.

Trade protection and why it matters here

Valve's trade protection system, introduced in 2025, is designed to give users a window, which we understand to be about 7 days, in which some traded items can be reversed. This is meant to help victims of scams and hijacked accounts, but details and exceptions can change. We explain the system cautiously in Steam trade protection explained. Do not treat it as a safety net that allows you to be careless with your key.

Best-practice setup for Canadian players

• Enable the Steam Mobile Authenticator and keep a backup of recovery information.
• Use a unique password and two-factor authentication on your email, as email controls account recovery.
• Bookmark your skin site, and check the domain before signing in.
• Only create an API key if you have a specific, trusted need, and revoke it after.
• Keep valuable skins in a separate account if you trade a lot.

Using your trade URL on gambling sites

Once your trade URL is saved, the usual flow is simple: choose the items on the site, wait for the bot's offer, check it and confirm it. Learn the full flow in How to Deposit Skins, and the reverse path in How to Withdraw to CAD. For wider scam awareness, read Avoiding scams on skin sites.

Gambling is for adults of legal age in your province (19+, or 18+ in Alberta, Manitoba and Quebec). If it stops being fun, our responsible gambling page lists help lines, including ConnexOntario at 1-866-531-2600.

Frequently asked questions

Where do I find my Steam trade URL?

Open your Steam inventory, go to Trade Offers, and look under 'Who can send me trade offers?'. Your Trade Offer URL is shown there and can be copied.

Is it safe to share my trade URL?

Generally yes. It only lets others send you trade offers, which you still must accept and confirm. Never share your API key, password or Steam Guard codes.

Do I need a Steam API key for skin sites?

Usually not for deposits. Some sites or tools ask for one to track offers, but you should be cautious and only provide it to operators you trust.

How do I revoke my Steam API key?

Visit the Steam Web API key page on steamcommunity.com/dev/apikey and choose to revoke the key, then change your password and review active sessions.

Why can't I get an API key?

Steam requires an account that is not limited, which typically means you have spent at least US$5 on Steam. Your account must also be in good standing.