A Steam trade URL is a link found on your Steam trade offers privacy page. It contains two parts: a partner number that identifies your account and a short token. Anyone who has the link can open a trade window with you without being your friend. Marketplaces, trading bots and trade sites all ask for it so they can send you offers.
Sharing the link is normal and safe on its own. A trade URL cannot be used to log in, take items or see private data. It only lets someone send an offer that you still have to accept and confirm.
Where do I find my Steam trade URL?
Open your Steam inventory, click Trade Offers, then the link labeled "Who can send me Trade Offers?" The trade URL sits near the bottom of that page. Copy the full link, including the token at the end. Sites that need it usually have a field in your account settings where you paste it once.
Should I change my trade URL?
Yes, whenever you want to stop old offers. The page has a button to create a new URL, which changes the token and makes the old link stop working. Do this after you stop using a marketplace, after a scam attempt, or if you get spam offers. Any site you still use will need the new link.
Be careful with people who ask for more than the trade URL. Nobody needs your password, your Steam Guard code or your Web API key to send you a trade. A message that says "paste your trade URL and login here to verify" is a phishing attempt. The trade URL page also lets you block offers from non-friends entirely, which is a good setting if you only trade with people you know.
One detail: a trade URL points to your Steam account, so a scammer can use it to look up your public inventory and target you with fake offers. That is not a security hole, but it is a reason not to post it in public chats if your inventory is worth a lot.