OAuth

OAuth is the protocol your shop uses to grant permission to third-party tools (Everlyst, accounting software, inventory tools) without ever sharing your Etsy password. You sign in with Etsy directly; Etsy gives the app a scoped token; the app uses that token to act on your behalf.

Why this is the right way

• No password sharing. Apps that ask for your Etsy login directly are a security nightmare and against Etsy TOS.
• Granular scopes. When you authorize an app, Etsy lists exactly what it can do - read your listings, write your listings, read your orders, manage your shop. You can refuse if a scope feels excessive.
• Revocable. You can revoke any app’s access from your Etsy account settings. The app stops working immediately.

Common scopes you’ll see

• listings_r - read your listings
• listings_w - create and edit your listings
• transactions_r - read your orders
• shops_r, shops_w - shop-level read/write

What to check before authorizing

• Is the app listed in Etsy’s official directory? Apps not in the directory aren’t blocked, but the directory is a vetting layer.
• Do the requested scopes match what the app actually does? An “analytics-only” app shouldn’t need write access.
• Is the app’s privacy policy clear about data retention and resale? Especially important for tools that pull buyer info.

Revoking access

Etsy account > Settings > Apps. One click. The app’s access ends immediately, but data the app already pulled (analytics history, exports) usually persists in their system.