Postman

Create a private environment variable named steamcall_api_key. Add X-API-Key: {{steamcall_api_key}} at the collection level and keep the current value out of shared exports.

Import the public OpenAPI artifact only after reviewing the target server. Do not publish environments containing credentials.

Verify the workspace

Confirm that the selected server is https://api.steamcall.com, keep the key in the environment's local current value, and disable synchronization for any workspace not approved to hold test credentials. Use a limited non-production key for manual requests.

Inspect the response status, documented envelope, and X-Request-ID. Remove console output and saved examples that contain user inventory data before sharing a collection.

Postman is a manual development surface, not a production runtime or secret manager. Reproduce validated requests in your server-side application with explicit timeouts, retries, and logging policy.