Sheet 02 · Etsy integration
How the Etsy integration works
Map Wooda uses a private application that is linked to a single Etsy shop, MapWooda, through version 3 of the Etsy Open API. The shop owner is the only person who can use it. It is not listed anywhere and is not available to other sellers.
The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.
Legend: what it does
- Reads the shop's profile and sections so it knows which shop it works with.
- Reads our own listings, prices and stock to keep our own records aligned with Etsy.
- Creates and edits our own listings: titles, descriptions, images, tags, prices, quantities.
- Reads our own orders so that maps get built and posted on schedule.
Out of bounds: what it will not do
- Open any other seller's shop, or gather information on other shops, buyers or listings.
- Scrape Etsy's website. The official API is the only channel, and rate limits are respected.
- Send messages to buyers. Order and shipping updates reach them through Etsy.
- Sell anything itself, or pull buyers out of Etsy's checkout.
- Sell, license or pass on Etsy data, push it to advertising or marketing platforms, run analytics on it, or train AI models with it.
Permissions requested
| Scope | Reason |
|---|---|
| shops_r | Read the shop name, sections and settings. |
| listings_r | Read our listings, prices and inventory counts. |
| listings_w | Create and change our listings, photos, tags, prices and quantities. |
| transactions_r | Read our own orders, so we can fulfil them. |
Route: the authorisation flow
- The owner signs in on a private page of this site and ticks I accept the app terms and privacy policy. The time and terms version are saved.
- The browser is handed to Etsy to approve the request. The Etsy password is never typed into this site.
- Etsy returns the browser to
https://mapwooda.com/manage/etsy/callbackwith a one-time code. The method is OAuth 2.0 with PKCE (S256), and the pending request expires after ten minutes. - The code is exchanged for an access token and a refresh token. Both are encrypted with AES-256-GCM before storage; the key lives in a separate secret.
- If the Etsy account is not the shop owner's, the tokens are discarded and nothing is stored.
Revoking access
Remove the app in the Etsy account's settings and it stops working at once. The owner area also has a disconnect button that deletes our stored tokens.
Contact
hello@mapwooda.com. That inbox is checked every working day and answered within two.
The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.