Security changed.
Follow the record.

Suspicious-message warnings in group chats

An official beta notice confirms the feature on 31 August. The supplied 1 September stable-release date still needs its specific release note.

Granular permissions & IP whitelisting for Publisher Keys (Valve announcement)

On 16 January 2026, Valve published an official Steamworks announcement ("NEW: Better permissions and controls for Web API Keys") confirming new granular permission tools allowing developers to segment Web API keys into discrete groups (General, Microtransactions, Economy, and Sales Data), restrict keys to specific App IDs, and enforce server IP whitelisting.

The Glaring Double Standard: This official announcement establishes that Valve has fully developed the technical infrastructure for granular API permissions and IP restrictions, but deliberately withholds them from regular user accounts (steamcommunity.com/dev/apikey). Regular user API keys remain monolithic, all-or-nothing credentials with no IP whitelisting—which is the exact technical omission enabling the multi-million-dollar API trade interception industry.

CS2 trades gain a seven-day reversal window

Valve's dated announcement introduces reversal of Counter-Strike item trades from the preceding seven days. While designed to mitigate hijacking, third-party economic audits (CSMarketCap ↗) recorded a $104M (-25%) collapse in market capitalization within 24 hours due to cash-trading disruption. As analyzed by Skinvault ↗, triggering a reversal inflicts an automatic 30-day trade lockout on the account. In summer 2026, Valve shifted from global midnight UTC resets to individual per-item minute timers (Skin.land ↗).

Valve publishes account security warning regarding SMS leaks

Valve's official announcement on May 14, 2025, addresses account security and SMS-based authenticators. While the notice focuses on SMS leaks and confirms no Steam systems were breached, it serves as an official security update on the submitted date.

Seven days before re-trading or re-marketing

The release notes cover items acquired through the in-game store, including the Armory, trade offers and the Community Market. The documented scope is wider than Armory items alone.

New-device restrictions verified on Help Pages

Steam's official support documentation confirms a 7-day trading restriction when logging in from a new device that has not been authorized for at least 7 days. While the exact rollout date of September 18, 2024, is not recorded as a changelog milestone, the functionality is fully documented.

Name-change trade cooldown implemented in 2024

Community and developer records confirm that in early 2024, Valve introduced an unannounced 2-to-4 hour trade cooldown immediately following a profile name change to mitigate rapid impersonation scams. Because Valve published no official press release, client changelog, or support article for this restriction, the submitted February 14 date lacks formal verification; the Steam Workshop guide serves as indirect community corroboration rather than official Valve documentation.

Key creation requires mobile confirmation

The introduction of mandatory Steam Guard mobile confirmation for Web API key creation is verified to have occurred in late 2023, as documented by third-party developer libraries. The exact date of December 4, 2023, represents the observed rollout period within the developer community.

Mandatory 2FA for setting game builds live goes effective

Valve's official Steamworks announcement on October 10, 2023, confirms that starting October 24, 2023, any account setting a build live on the default branch of a released application must authorize the change via SMS or the Steam Mobile App. This change directly updated the SetAppBuildLive Web API.

Custom biography content warnings observed by community

Steam community reports starting in July 2023 document that custom profile biographies containing external links or trigger words began displaying automated content warnings. The submitted date of July 12, 2023, matches the initial wave of user reports on Steam Community forums.

Profile link filtering and editing cooldowns active

Steam's official support documentation confirms that links in custom biographies are filtered, and abusive name or avatar changes can trigger editing bans. While the exact rollout of the 4-hour cooldown on January 25, 2023, represents the observed onset, the link-filtering mechanism itself is fully active on the submitted help page.

Steam Client transition to OAuth refresh and access tokens

Valve's major client and mobile app updates in October 2022 overhauled the Steam authentication system. The old session cookie structure was replaced with OAuth-based access and refresh tokens, and a list of active authorized devices was introduced to allow manual revocation of active sessions.

QR sign-in and authorized-device management

Valve's 12 October announcement describes QR sign-in, approval or denial of sign-ins, and a device list that can revoke account access.

Trade cancellation endpoints removed from public API list

Developer records confirm that in May 2022, Valve silently removed trade management endpoints such as IEconService/CancelTradeOffer and DeclineTradeOffer from the Web API (documented in node-steam-tradeoffer-manager #325). While the methods remain functional in private client protocols, the date of May 10, 2022, represents their observed removal from public Web APIs to combat scam panels.

Dota 2 items receive a seven-day trading cooldown

On May 25, 2020, alongside the International 10 Battle Pass release (blog.dota2.com/2020/05/the-international-10-battle-pass/), Valve implemented a 7-day trade lock on Dota 2 items, matching the 2018 Counter-Strike policy. This restriction applies to all traded items and Market purchases.

Traded CS:GO items receive a seven-day cooldown

The official release notes confirm the date and restriction. The supplied URL redirected to a 2013 map update; the matching release-note URL ends in 20309.