THE KEY POINT
Revoke an exposed API key through Steam. Then secure the account separately: removing a key does not undo stolen credentials or a completed trade.
01
Open Steam's API-key page yourself
Steam's trade-redirection article points to steamcommunity.com/dev/apikey for revocation. Open that address directly. If sign-in is required, verify the Steam domain before entering credentials; do not start from a link sent by someone claiming to repair your trades.
A Web API key and a Steam Trade URL are different account details. The trade URL gives a destination for offers. The API key authorizes API access and should remain private. A copied trade URL is not a replacement for revoking a key.
02
Remove the exposed key, not your evidence
Use the revocation control for the key listed in your account. If the page instead offers key registration, that is a different state; creating a key is not a recovery step. Keep the page's account state in your incident notes without copying the secret into a support message.
Record what led you to this check: a key shared with an untrusted site, an unfamiliar registration, or an unexpected trade replacement. Those observations help explain the incident without giving another person access to the account.
Revocation addresses API access. It does not undo a completed trade or secure compromised email and login credentials by itself.
03
Secure the other access paths
Steam explains that redirected trades do not require an API key when an attacker already controls the account or computer. Revocation therefore belongs alongside the account-security checks, including compromised credentials, email access and unsafe software.
Use the linked account-recovery guide if you cannot sign in. Keep any cancelled and replacement offer references together, and review the actual recipient before another trade. A successful revocation does not establish that a replacement offer is legitimate.
04
Send a useful incident summary
- Identify the original and replacement offers separately.
- Include the time and account actions you observed.
- Remove keys, passwords and recovery information from evidence.
- Continue through official Steam Support for account recovery.
BEFORE YOU CONTINUE
Quick checklist
- Official API-key URL opened
- Exposed key revoked
- Account access reviewed
- Trade references retained without secrets
Official sources
Read the official documents below for the service’s rules and account instructions.