Steam trade and API-key safety for skin sites
A legitimate Steam OpenID sign-in redirects to Steam so the third-party site receives an identity claim rather than your password. Trade confirmation is a separate action: inspect the recipient, items and confirmation details in Steam before approving it.
Short answer
Valve documents Steam Guard Mobile Authenticator, trade holds and OpenID. A personal Steam Web API key is for API access and is not required merely to verify a normal trade offer. Unexpected keys, lookalike domains, chat-based support and changed recipients are reasons to stop and secure the account.
What to compare
Open the destination yourself, verify the exact hostname, keep Steam Guard enabled, compare the on-site trade code with the Steam offer, inspect every item, and reject any request for an authenticator code, password or recovery code.
- Steam OpenID
- Steam Guard and holds
- Steam offer and recipient
- Personal API-key exposure
Evidence boundary
This is a desk-researched comparison of published rules and official support material. It is not a deposit, wager, KYC or withdrawal test, and an unknown country remains unknown.
Primary sources
- Steam Support — Steam Guard Mobile AuthenticatorSources observed 2026-08-29
- Steam Support — Trade and Market HoldsSources observed 2026-08-29
- Steamworks — User Authentication and OwnershipSources observed 2026-08-29
- Steam Community — Steam Web API DocumentationSources observed 2026-08-29