What is steam API (key)

[serenush]

I see in the settings that dont share api key and stuff...
Also i see its ccommon in selling sites like bitskins skinbay etc they have an API section
How is it helpfull and stuff? like what do i do with it ?

[nullable]

You don't do anything with it. It's a developer tool for the most part. Normal users should pretty much never have the api key populated. It's often used in part on compromised accounts by scammers to enable them exert some control over the account and redirect traded items their way instead of toward intended recipients.

[Zekiran]

If there's something in it, and you did not put it there on purpose while knowing what it does, REMOVE IT, because a scammer has an attempt on your account.

[Sazzouu]

Originally posted by Brockenstein:

You don't do anything with it. It's a developer tool for the most part. Normal users should pretty much never have the api key populated. It's often used in part on compromised accounts by scammers to enable them exert some control over the account and redirect traded items their way instead of toward intended recipients.

Wrong
Valve completely killed the controll part of API keys. It is a flat information retreiving API nowadays. You can not controll any part of your Account or the community with it

[Cathulhu]

While that is true, it allows the scammer to constantly monitor your activity to redirect trade with an open session created when the user entered their login credentials on a fake website.
It still is a valuable tool for scammers.

If you don't know what the Steam API key is for, you don't need one.
That much is still true.

[Sazzouu]

Originally posted by Cathulhu:

While that is true, it allows the scammer to constantly monitor your activity to redirect trade with an open session created when the user entered their login credentials on a fake website.
It still is a valuable tool for scammers.

Sure but that part could be easily done "manually" (literally or with scripts) without this API. If a scammer got into your Account then your activity will be your smallest problem... Especially when not having any authenticator active

[Cathulhu]

Still true. That doesn't mean users should ignore the Steam API section or give anyone their API key without good reasons.

[J4MESOX4D]

It's a bit weird but the API key has very limited usage to users except the ability for someone (hijacker for instance) to be able to take control of aspects of an account with the most serious being trades. Valve don't even alert the user if an API key has been generated or changed in any way and there's no cooldown or auth confirmation as a countermeasure in what is the most common and effective scam method in existence right now.

The user will always be responsible for their account and it is their fault if their credentials get phished but the API key feature is just so open and vulnerable. For all the old-school scam security Valve has in place that's so 2015ish, it's crazy they don't do more about this.

[Sazzouu]

Originally posted by J4MESOX4D:

except the ability for someone (hijacker for instance) to be able to take control of aspects of an account with the most serious being trades.

No
The worst thing they can do is cancle / decline trades and that only if you are logged in (which apparently can be done with a simple POST request and a given trade-id). But "taking controll" is far from what API Keys can actually do

A little different are publisher API Keys but these HAVE to be created by two-factor authentication - you get an E-Mail on creation and it only gets unlocked when you authorize it via your inbox as well as it delivers an IP whitelist. But the simple one-click WebAPI Key you can create at any given time has literally no vulnerabilities at all. As I said the worst thing they can do is prevent you from trading and that only if your whole account got compromised.

[nullable]

Well I was speaking high level to make it clear it's nothing most users need to fuss with. If you want to argue the technical details you can do that without needlessly impeding and undermining other users. Because regardless of your information, an account that mysteriously has the api key populated is usually evidence that its compromised. The api key still has some use in scams. And clearing the api key is still part of the recovery process. Give us a call when none of those things are the case anymore.

Beware falling victim to not being able to see the forest for the trees.

[J4MESOX4D]

Originally posted by BeatZ:

Originally posted by J4MESOX4D:

except the ability for someone (hijacker for instance) to be able to take control of aspects of an account with the most serious being trades.

No
The worst thing they can do is cancle / decline trades and that only if you are logged in (which apparently can be done with a simple POST request and a given trade-id). But "taking controll" is far from what API Keys can actually do

Originally posted by BeatZ:

Originally posted by J4MESOX4D:

except the ability for someone (hijacker for instance) to be able to take control of aspects of an account with the most serious being trades.

No
The worst thing they can do is cancle / decline trades and that only if you are logged in (which apparently can be done with a simple POST request and a given trade-id). But "taking controll" is far from what API Keys can actually do

If the hijacker can cancel trades then they are in control of this aspect. Sure they can't do anything without the end-user confirming but a snapshot of the intended trade then allows them to capture the destination account, impersonate and then instantly send an identical trade offer. Everything else the API key does is no real concern for common users but as long as an account's API key is out of their control, every trade they make can be monitored, cancelled and essentially re-directed through impersonation until it is revoked and rectified.