ABOUT Steamworks Development

Official Group for Steamworks Development Support

NOTE: This group is restricted and visible only to accounts with Steamworks access. Announcements however are public.

This community of Steamworks developers is intended for sharing information regarding Steam and Steamworks development.

Please use the Discussions to ask Steam and Steamworks related questions. You'll also find FAQs and responses to other common questions in there.

And we'll post announcements for relevant updates and changes involving Steamworks SDK.

Steamworks Site
Steam Stats

VIEW ALL

POPULAR DISCUSSIONS

VIEW ALL (352)

RECENT ANNOUNCEMENTS

NEW: Better permissions and controls for Web API Keys

January 16 - TomG | 11 Comments

We recently introduced a new set of permissions tools for Steamworks Web API keys to make it easier to control access to things like microtransactions, sales data, and more generic API calls. Existing API keys and API usage will not be interrupted, but developers now have additional tools to manage their API keys.

What changed?

Originally, there was a single Web API key structure: developers could make a subgroup with one or more appIDs, and generate an API key to work with those appIDs.

Then in 2025, we shipped a new financial services API, and calls to that API required a unique kind of API key specific to sales data.

Now, we've introduced tools that allow developers to set permissions on a Web API key to include or exclude a subset of API methods:

Microtransactions for initializing, finalizing, and reconciling in-game purchases.
Sales Data calls to the IPartnerFinancialService API.
Economy calls for games that use the Steam Inventory Service.
General API calls for things like authenticating a user or checking ownership of a DLC-- anything not included in the first three permissions.

As a reminder, Web API Keys also have the ability for whitelisting IP addresses, as an optional added security method. Developers can add or manage the IP Whitelist for a given key on that same Web API Key Management page

Remember: Publisher Web API keys provide access to sensitive user data and protected methods. These keys are intended to be used for Web API requests that originate from secure publisher servers. The keys must be stored securely, and must not be distributed with a game client. All Web API requests that contain Web API keys should be made over HTTPS.

What do developers need to do next?

Many games on Steam don't use Web API keys at all. If you don't make use of Web API keys, nothing has changed and there's no work for you to worry about.

For existing Web API keys, we haven't changed anything that would interrupt a game or a developer. Financial Web API keys are automatically set to just support game sales data, and normal Web API keys are automatically set to support General, Economy, and Microtransaction calls, just as before.

However, some studios may prefer to generate new keys or edit permissions on existing keys to more narrowly manage different use cases. Steamworks admin accounts can visit their Groups page at https://partner.steamgames.com/pub/groups/ and click on any existing group that has a Web API Key to manage that key (or create new groups and keys as needed).

For more detailed instructions on how Web API Keys are created and managed, check out the newly updated API Key documentation at https://partner.steamgames.com/doc/webapi_overview/auth

Let us know if you encounter any issues or concerns with these new options. Thanks!

-The Steam Team