Are Autobuy Bots Allowed? TOS, Bans and Gray Zones
"Is this even allowed?" is the right first question about any bot that spends your money, and the answer is genuinely: it depends where the bot is pointing. Some marketplaces publish APIs and invite automation; others tolerate it; Steam itself has long been hostile to automated purchasing. This is a sober tour of the rules as they stand in late 2026 — where the lines are, where the gray starts, and how to keep your accounts on the right side. One thing up front: this is not legal advice, and terms of service change. Read the actual documents for any venue you use.
The three-tier reality of "allowed"
People argue about bots as if there were one rulebook. There are dozens — every marketplace writes its own terms, and Valve writes the ones that matter most for your Steam account. Practically, automation falls into three tiers:
- Invited. The venue publishes a public API with documentation, key management, and rate limits. Building against it is the intended use — the venue wants programmatic traders.
- Tolerated or ambiguous. No public trading API, but no aggressive enforcement against third-party tools either. Extensions and watchers live here. The rules can tighten without notice.
- Prohibited or hostile. The platform's terms restrict automation, or its behavior (rate limiting, captchas, bans) makes the stance clear regardless of what the fine print says.
The safety of your bot is mostly determined by which tier its target sits in — before you write or rent a single line of code.
Where automation is invited: published APIs
Several third-party marketplaces publish public trading APIs — DMarket and Waxpeer are two that document programmatic buying openly, and they're not alone. On these venues, a bot isn't a loophole; it's a supported client. You register, generate keys, respect rate limits, and trade. The venue profits from your volume, so incentives align.
Even inside the invited tier, the permission has edges. API terms still typically prohibit things like abusive request volumes, market manipulation, and circumventing fees — reasonable-actor rules, not anti-bot rules. Stay inside the documented endpoints and published limits and you're using the product as designed. Our guide to autobuying on DMarket walks through what that looks like in practice, and the venue itself is covered in the DMarket review and Waxpeer review.
The gray zone: scraping and UI automation
A different thing entirely: pointing a headless browser or scraper at a marketplace that offers no API, simulating clicks, defeating rate limits or captchas. Even where the terms don't spell it out, most sites' terms restrict automated access outside sanctioned channels, and enforcement is at the operator's discretion. The practical risks stack up:
- Account termination — often with balances or pending trades caught inside.
- Silent degradation — shadow rate limits and captcha walls that make your bot unreliable before it's ever banned.
- Breakage — UI scrapers die every time the site ships a redesign; APIs are versioned, front-ends aren't.
The gray zone is where most horror stories come from — not because scraping is evil, but because you're building on a surface the operator never promised you and can revoke without notice.
Steam: the automation-hostile core
Steam deserves its own section because every skin ultimately lives there. Valve has never courted purchase automation: there is no public API for buying on the Steam Community Market, and Valve's subscriber agreement and enforcement history make clear that it acts against automation and commercial exploitation of its platform at its own discretion. As of late 2026 nothing about that stance has visibly softened. The widely-observed practice among traders is:
| Activity | Risk posture |
|---|---|
| Bots buying on third-party venues via their public APIs | Lowest — the item transfers touch Steam only as ordinary trades |
| Third-party tools reading public Steam data (prices, inventories) | Common and generally quiet, but rate-limited and revocable |
| Automating purchases or trades on Steam itself | The zone traders avoid — Valve bans at its discretion, and a trade ban strands the whole inventory |
The asymmetry is brutal: a banned marketplace account loses you one venue's balance; a Valve action against your Steam account can strand everything you own. That's why serious automation lives on third-party rails and treats Steam as the vault you never point a robot at. The venue-level tradeoffs are covered in Steam Market strengths and weaknesses.
Hedging account risk, whatever you run
Rules you can't control; exposure you can. The standing practices, whichever tools you use:
- Prefer invited surfaces. Documented APIs over scraping, every time there's a choice.
- Scope and rotate keys. Buy-only permissions where offered, revoke anything unused — the full hygiene guide is in API key security.
- Keep balances small. Prepaid, per-venue amounts you can afford to have frozen during a dispute.
- Don't multi-account or evade. Working around a ban or limit converts a gray zone into a clear violation everywhere.
- Reread terms occasionally. Marketplace policies shift; "per its published terms" always carries a date.
For what it's worth, this is the reasoning behind how cs2stack (disclosed: our tool) is built — it buys only through marketplaces' own APIs on venues that invite automation, and never automates Steam itself. The rest of the defensive playbook, from caps to kill switches, is in the autobuy safety checklist.
So: are autobuy bots allowed? On venues that publish trading APIs — yes, by design, within their terms. Around scraped surfaces — at the operator's sufferance. On Steam itself — treat the answer as no. Again, not legal advice; just the map as it reads in late 2026.