What has shipped

Version 1.0.2 of the bot you run on your own server, with fixes from the first installs on real servers. Installing is easier for a beginner, and a few more settings ask for your dashboard password.

• Ubuntu 26.04 is supported, beside Ubuntu 22.04 and 24.04 and Debian 12 and 13.
• Setup lists the Steam Guard files you uploaded and you pick one by its number. That is all: you no longer paste a path. A file that cannot be used is named at once, with what to do.
• Once setup has saved the two secrets from that file, it offers to delete that one file from the server. No other file is touched.
• Your own Steam profile link works as it is, also a custom one with your own name in it. Setup shows whose profile that is and you type y or n.
• Your dashboard password and a one-time sign in link are printed last of all, and the installer waits until you press Enter to say you saved them.
• The owner command !RATECHANGE changes one rate at a time: currency, BUY or SELL, and the amount, as in !RATECHANGE TF BUY 10. BUY is the sets you buy for one key, SELL the sets you sell for one.
• A command sent without its details answers with its format and an example to copy.
• !SELLCHECK counts only the sets the bot will really take, and the notice of a finished trade in Steam chat now says what the bot really sent and received.
• The dashboard asks for its password again for the Card Suppliers the bot buys from, the Telegram bot your notices come from, and the three links the bot gives your customers.
• Already running an earlier version? After it updates, run the installer on your server once more, as the Licence page of your dashboard reminds you: sudo bash /opt/stx-bot/current/install.sh (it keeps your settings and does not restart the bot).

Version 1.0.1 of the bot you run on your own server. The install guide and the README that comes with the bot show every command.

• The dashboard has Start, Stop and Restart buttons for each bot, a search box that finds any setting, and customer names in the trade lists in place of long Steam IDs.
• The dashboard asks for its password again before a sensitive change: the owner, the admins, where the dashboard answers, the Telegram chat, the trade limits, the automatic pricing settings, a rate moved by more than 25% against you, and every withdrawal.
• The installer is now part of every signed release. Repair, uninstall, running it again and moving the dashboard to your own domain use the copy on your server, so nothing is downloaded again after the first install.
• The first download can be checked against our signature before you run it. The install guide shows the few commands.
• Setup lists the Steam Guard files it finds and asks which one is for the bot. Only that one is copied.
• Already running an earlier version? After it updates, run the installer on your server once more, as the Licence page of your dashboard reminds you: sudo bash /opt/stx-bot/current/install.sh (it keeps your settings and does not restart the bot).

Run our Steam trading bot on your own Linux server, with its full dashboard, for 30 TF2 keys paid once from your key bank. It is a lifetime licence with lifetime updates: every update is included.

• Buy it from Bot Script in your dashboard. One licence runs on one server, with as many bots on it as you like.
• Install it with one command: the self-host install guide shows every step and what you should see.
• Try the dashboard first in the live demo.

Referring somebody now earns points instead of free days. Every TF2 key the people you refer spend with us earns you 10 points, and every 170 points becomes a TF2 key in your key bank, automatically. Refer a friend shows everybody you referred, what they have spent and what it earned you.

A listed bot can now be featured for 1 TF2 key a week. Featured bots appear in their own table at the top of their page, above the full list, and stay in the full list too. Buy weeks from your listings page; more weeks add to the time left, and we remind you two days before it ends.

Listing somebody else's bot is no longer possible. A new listing waits until somebody signs in to SteamTradeX with the bot's own Steam account and allows it. Then a person reviews it as before.

• Signing in as the bot takes you straight to the request, and the top bar shows a red dot until you answer it.
• Declined by mistake? Ask again from your listings page.
• Listing while signed in as the bot itself needs no approval.

We now tell you when something needs you, by email, and by Telegram too if you connect it from your account page.

• When your bot stops, is signed out of Steam, cannot sign in, or cannot confirm trades.
• Seven, three and one day before your licence or free month runs out, and when it does.
• Three days before a free advert month ends, and when an advert is approved or turned down.

Connecting Telegram is one button: it opens our bot, you press Start, and that is it.

Everybody's first advert in the directory now runs for thirty days at no cost.

• The month starts the day we approve the banner, so time waiting for review is not lost. Every advert is still read by a person before it appears.
• Paid adverts sit above free ones. Free adverts fill the slots left over.
• One free month per person. If a banner is turned down, the month is kept for the next one.
• Banners are now 720 by 90 pixels, the size already used across this market.
• There is one set of nine adverts, shown at the top of every page of the directory, rather than a separate set for each kind of bot.

Same platform, same people, new name and a home of its own at steamtradex.com. Your account, bots, keys and history are unchanged, and the two factor entry in your authenticator app keeps working under its old name.

The ten rotating free bot slots are gone. Every customer now gets their first month free instead, with nobody waiting in a queue for a slot.

• Thirty days on your first bot, counted from when it first runs rather than when you sign up, so setting it up costs you none of it.
• One free month per person. Further bots are one key a month from the start.
• Bots that held a free slot have been given the free month, and are billed normally after it.

The directory now sells its top slots. An advert is paid for out of the key bank in whole hundredths of a key, charged by the hour for the hours it was actually shown, and it stops when the balance runs out rather than running up a debt.

Every advert is read by a person before it appears, and so is every listing. Nothing reaches a public page unreviewed.

Bot owners can list their shop, set which currencies it takes, and fix their own listing afterwards without asking us. A listing carries the bot's Steam ID, so a customer reading the directory can check who they are about to trade with before they send anything.

There is now an API for reading a Steam inventory, with keys you issue and revoke yourself from the dashboard.

• One key buys a month, drawn from the same key bank the bots are paid from.
• The dashboard shows the month you are in and what a 402 means when you get one.
• Requests go out through a pool of addresses, and the panel says how many customers that pool can carry rather than leaving it to be discovered.

A bot's own log is on its page, filtered by severity, with the reason given the whole width of the row. The moment you need this is the moment the bot is not running, which is exactly when a truncated error message is no use to anybody.

Licence time is bought with TF2 keys, one key a month, and the keys sit in a bank until they are spent.

• Deposit once, spend whenever. A key deposited in March is a month, whatever keys are worth in September.
• Keys are credited when you accept the trade, not when it is sent. A trade Steam is holding has not arrived yet.
• Keys that turn up without a deposit to attach them to are recorded and attached by hand rather than vanishing. Somebody who paid and was not credited has something to point at.
• Every balance on the site is a sum over its own history, so the number and the list under it cannot disagree.

Sign in with Steam in one click, or register with an email and a password. Both routes end at the same account, and both need a verified email address, because Valve does not give us one and a customer we cannot reach is a customer we cannot warn.

• Two factor on the account itself, with backup codes.
• A list of your live sessions, and a way to sign other devices out.
• Email changes confirmed from both addresses.
• A second factor asked for again before anything dangerous, not only at sign in.

Your bots, their state in words rather than in codes, and buttons that actually do something: what you ask for is reconciled against what is happening, so a bot that says it is running and has stopped talking to us is shown as a problem rather than as running.

Every terminal state names whose problem it is. "Steam Guard is blocking the login" is something you can fix in five minutes. "It is broken" is a support ticket.

Bots run in their own containers on our hardware, each one locked down, each one asking the control plane for its settings rather than carrying them. A bot that cannot reach us keeps trading on the settings it already had instead of stopping.

Steam rate limits inventory reads hard enough that no hosted bot can rely on them alone. So a bot can be pointed at whichever inventory service you already pay for, and it falls through a chain of them rather than giving up on the first failure. Steam itself is one of the options.

Rates are set and stored in hundredths of a key, so nothing is ever a rounding of a rounding, and an operator can close a currency without deleting the rates they had set for it.

Every command the bot answers is declared once, in one place, and the commands page on this site is generated from it. The list on the site cannot drift from what the bot actually does, because it is the same list.

The arithmetic a card bot lives on: how many cards make a set, how many sets somebody needs for the level they asked for, and which of the sets they already hold can be used. Checked against real Steam accounts rather than against our own assumptions.

A bot's Steam credentials are encrypted with a key that is not in the database, and each customer's data is fenced off inside Postgres itself rather than by every query remembering to filter. The fleet wide key being used to read one customer's row is noticed and recorded.

The connection to Steam knows the difference between a failure worth retrying and one that is not, so a bot with a wrong password stops trying instead of hammering Valve until the account is rate limited. Trade offer states are read from what Steam actually says rather than inferred from how long it has been.