Steam Trade URL safety for CS2 buyers and sellers

A Steam Trade URL lets another Steam user open an offer to the correct account. It is not a password and does not authorise a completed trade, but it should still be handled carefully and verified against the signed-in account.

Copy the URL from Steam

Use Steam’s own Trade Offers privacy page while signed in: Trade Offer access URL. Copy the complete URL, including the partner and token parameters, and save it only in the profile intended to receive items.

Understand what the URL can and cannot do

The URL targets the recipient account and allows the offer composer to open. It does not expose the Steam password or approve a transfer by itself. It also does not guarantee that a third-party marketplace can preselect every seller asset in the Steam interface.

Verify ownership against the signed-in Steam ID

A marketplace should associate the saved URL with the verified Steam session. If the account changes, update the URL from that account. A buyer should not paste a URL received from an unknown chat message without confirming the recipient.

Inspect every offer before confirmation

Check the recipient, exact asset names, quantities and whether the other side is adding or requesting unexpected items. Steam’s mobile confirmation is a final security step, not a routine button to press without reading.

Regenerate a URL when exposure is suspected

If a Trade URL was posted publicly or sent to the wrong person, use Steam’s controls to create a new URL and update the marketplace profile. Regeneration invalidates the old token, but it does not reverse offers or trades already confirmed.

Keep trade evidence

For a marketplace transaction, retain the offer reference, expected asset IDs and the recipient identity. This helps distinguish a cancelled attempt from a completed transfer and gives support a clear record if a dispute occurs.