How to create a Steamworks Financial API Group key

Before you start

You need administrator permission in the Steamworks partner account. If you are not an administrator, the Steamworks home page lists the account administrators who can create the group or change your permissions.

Decide where the key will be used and how it will be stored before creating it. Valve describes publisher keys as sensitive credentials and says requests containing them should use HTTPS.

Create the Financial API Group

1. Sign in to Steamworks with an administrator account.
2. Open Users & Permissions.
3. Select Manage Groups.
4. Create a new group and choose the Financial API Group type.
5. Open the newly created group page.
6. Copy the Financial Web API key shown on that page and store it securely.

Valve’s documentation states that a Financial API Group has no users and no apps associated with it. The key is dedicated to retrieving financial data for the partner account and is not limited to selected applications.

Do not use a personal Steam Web API key

The key registered through the Steam Community Web API page is a user key. It does not provide the financial permission required by IPartnerFinancialsService/GetAppWishlistReporting. If a wishlist reporting request returns an authorization error, confirm that the credential came from a Steamworks Financial API Group.

Understand the scope before copying the key

A Financial API key can retrieve financial data for all applications in the partner account. It is broader than an ordinary publisher group key whose access can be constrained by associated App IDs and permission categories. Treat the Financial API key like a password with access to sensitive business information.

• Do not place it in source control, screenshots, email, support tickets, or public logs.
• Do not ship it inside a game client.
• Send API requests over HTTPS.
• Revoke or replace the key if you believe it has been exposed.

IP allowlisting

Valve recommends adding trusted IP addresses through Manage WebAPI Key when requests come from a server with stable outbound addresses. Once an allowlist is set, calls from other addresses receive a 403 response.

A fixed IP allowlist is usually unsuitable for direct requests from a phone on changing Wi-Fi and mobile networks. Choose the access model that fits where the key will actually be used, and do not assume an allowlist can replace secure key storage.

Using the key for wishlist reporting

The wishlist reporting endpoint accepts the key, a Steam App ID, and a date. Valve allows the key as a request parameter or in the x-webapi-key header. Keeping it in the header helps prevent the credential from appearing in URLs and URL histories.

For the rest of the process, see how to check Steam wishlist additions and when the statistics update.