cURL

Set STEAMCALL_API_KEY in your environment, then reference it in the header.

curl --fail-with-body --max-time 15 \
  'https://api.steamcall.com/v2/steam/market/price?app_id=730&market_hash_name=Example&currency=1' \
  --header "X-API-Key: $STEAMCALL_API_KEY"

Avoid inline literal credentials because shell history and process inspection may retain them.

Inspect failures without leaking headers

Use --fail-with-body to return a failing exit status while retaining the documented error body for local inspection. Add --dump-header only to a protected temporary file if you need X-Request-ID, then remove it; never share a dump containing authentication headers.

Percent-encode user-supplied query values rather than assembling URLs with shell string concatenation. For repeated or automated requests, move the integration into a server-side client with structured input validation and logging.