Etsy Integration — Technical & Security Overview

MakerFlow is a commercial software-as-a-service inventory management platform built for small makers and manufacturing businesses that physically produce the goods they sell.

MakerFlow is offered to third-party sellers, including Etsy sellers. Each seller creates a private MakerFlow workspace and voluntarily connects their own Etsy shop through Etsy’s standard OAuth authorization process.

The Etsy integration allows sellers to connect their Etsy inventory with MakerFlow’s production and inventory system. MakerFlow uses Etsy’s official Open API v3 exclusively and does not scrape Etsy webpages or use unofficial or undocumented endpoints.

Etsy API access is used solely to provide inventory-management functionality to the seller who authorized the connection.

MakerFlow is designed for businesses that turn components or raw materials into finished products.

For example, when a candle maker records the production of 20 candles, MakerFlow can increase the finished candle inventory while deducting the jars, wax, wicks, fragrance, labels, and other components consumed during production.

The Etsy integration allows that finished-goods inventory to remain synchronized with the seller’s Etsy shop.

After a seller connects Etsy:

• Etsy listings are imported and matched to MakerFlow products.
• Sellers can review and manually map listings that cannot be matched automatically.
• MakerFlow maintains the seller's finished-goods inventory quantity.
• Inventory changes in MakerFlow are synchronized to mapped Etsy listings.
• Etsy sales are recorded in MakerFlow and reduce the corresponding finished-goods inventory.
• Updated quantities can then be synchronized across the seller's other connected sales channels.

MakerFlow acts as the seller’s inventory system of record after a product is mapped. Etsy remains one of the sales channels through which that inventory is offered.

MakerFlow implements the OAuth 2.0 authorization-code flow with PKCE using S256.

The authorization process works as follows:

• A signed-in MakerFlow user selects Connect Etsy from within their workspace.
• MakerFlow verifies that the user is authorized to access that workspace.
• MakerFlow generates a cryptographically random OAuth state value and PKCE code verifier. These are stored server-side with a short expiration and associated with the requesting user and workspace.
• The seller is redirected to Etsy's own authorization and consent screen.
• After authorization, Etsy redirects the seller to MakerFlow's fixed HTTPS production callback.
• MakerFlow validates and atomically consumes the OAuth state. The state is single-use and expiration is enforced.
• MakerFlow exchanges the authorization code and PKCE verifier for Etsy tokens through a server-to-server HTTPS request.
• MakerFlow establishes the connection and imports the authorized shop's listings.

The authorization-code exchange occurs entirely on the server. Etsy authorization codes are not persisted.

MakerFlow never receives or handles the seller’s Etsy username or password.

Etsy application credentials and OAuth tokens are handled only by MakerFlow’s server-side systems.

Specifically:

• Etsy application credentials are maintained in server-side environment configuration and are never delivered to the browser.
• Etsy access and refresh tokens are never exposed to the browser or rendered in the MakerFlow interface.
• OAuth tokens are stored separately from seller-visible application data in a dedicated credentials table.
• Row Level Security restricts the credentials table to MakerFlow's privileged server role. Authenticated customer sessions cannot directly query Etsy credentials, including credentials associated with their own workspace.
• Server-side authorization checks ensure that Etsy connections and operations belong to the requesting user's workspace.
• Tokens, application credentials, and OAuth authorization codes are not returned in application API responses or customer-facing error messages.

Access tokens are refreshed server-side as needed. MakerFlow handles rotating refresh tokens atomically and serializes concurrent refresh operations to prevent multiple processes from attempting to rotate the same credential simultaneously.

If Etsy rejects previously authorized credentials, MakerFlow stops scheduled API activity for that connection, marks the connection as requiring attention, and prompts the seller to reconnect.

MakerFlow requests only the Etsy scopes required to provide its inventory-management functionality:

MakerFlow does not request Etsy scopes for messages/conversations, payments, or buyer contact information.

MakerFlow does not request or store buyer email addresses, phone numbers, shipping addresses, payment information, or Etsy messages.

The buyer display name associated with an Etsy receipt may be stored on the seller’s corresponding sales record so that the seller can identify the transaction within their own MakerFlow sales history. It is visible only within that seller’s workspace and is not used for any other purpose.

MakerFlow limits Etsy-derived data to information necessary to provide the authorized seller’s inventory-management functionality.

This includes:

• Etsy shop ID and shop name
• Listing and variation/product identifiers
• SKU and listing title
• Inventory quantities
• Receipt and transaction identifiers
• Quantity sold
• Sale and cancellation status
• Relevant transaction timestamps
• Buyer display name for identification within the seller's own sales history
• OAuth credentials required to maintain the authorized connection

Listing and inventory API responses required to perform inventory operations are processed as necessary but are not retained as complete raw API responses.

Etsy-derived information is associated with the workspace of the seller who authorized the connection.

MakerFlow is a multi-tenant application in which each seller’s data is isolated by workspace.

Etsy connections, listing mappings, sales records, and related data are associated with a specific MakerFlow workspace.

MakerFlow enforces this isolation through both database and server-side controls:

• Row Level Security is enabled on Etsy-related application tables.
• Workspace data is accessible only to authenticated members of that workspace.
• OAuth credentials are restricted to MakerFlow's privileged server role.
• Server operations verify both workspace membership and connection ownership before accessing an Etsy connection.
• Etsy webhook events are routed only to the MakerFlow workspace associated with the authorized Etsy shop.

Automated security tests cover these boundaries, including unauthorized workspace access, direct client access restrictions, OAuth state replay, and incorrect-channel callback attempts.

When an Etsy shop is connected, MakerFlow imports active listings and attempts to match them to MakerFlow products using SKU information. Listings that cannot be matched automatically can be mapped manually by the seller.

Once mapped, MakerFlow maintains the authoritative finished-goods quantity for that product.

When inventory changes because of production, receiving, an adjustment, or a sale, MakerFlow can synchronize the resulting quantity to Etsy and the seller’s other connected channels.

Etsy sales reduce the mapped finished product only. MakerFlow’s component inventory is consumed when the seller records production, rather than being deducted directly by a channel sale.

MakerFlow protects against duplicate inventory changes by processing Etsy transactions using unique channel, order, and transaction identifiers. Duplicate deliveries do not decrement inventory more than once, and cancellations are also protected against duplicate processing.

MakerFlow uses background retry, rate-limit handling, and inventory reconciliation processes to recover from temporary API failures and identify genuine inventory drift.

Communication between MakerFlow and Etsy occurs over HTTPS through Etsy’s official APIs.

Etsy API requests are made server-to-server rather than directly from the seller’s browser.

Incoming Etsy webhook deliveries are cryptographically verified before processing. MakerFlow validates webhook signatures and applies replay protections before accepting an event.

Resource URLs contained within webhook events are also validated for HTTPS, expected Etsy hosts, appropriate resource paths, and the corresponding Etsy shop before MakerFlow makes a request.

Unverified or improperly scoped webhook requests are rejected.

An Etsy seller can disconnect their Etsy integration from MakerFlow.

When the connection is disconnected:

• Stored Etsy access and refresh tokens are deleted.
• Etsy listing mappings associated with the connection are deleted.
• The Etsy connection record is removed.
• Scheduled API activity for the disconnected shop stops.

The seller’s historical sales and inventory records are retained as part of their MakerFlow business history, including the limited transaction information previously imported from Etsy.

A seller may reconnect their Etsy shop later by completing Etsy’s standard OAuth authorization flow again.

If a seller revokes MakerFlow’s access through Etsy, subsequent authentication failures cause MakerFlow to stop scheduled API activity and request that the seller reconnect before Etsy synchronization can resume.

Etsy-derived data is used only to provide inventory-management functionality to the seller who authorized access.

MakerFlow:

• Uses Etsy's official API and does not scrape Etsy.
• Does not sell Etsy-derived data.
• Does not share Etsy-derived data with data brokers.
• Does not use Etsy data for advertising.
• Does not use Etsy data for lead generation.
• Does not use one seller's Etsy data to market MakerFlow to another seller.
• Does not build seller or buyer profiles unrelated to providing MakerFlow's inventory-management functionality.

MakerFlow’s Privacy Policy, Terms of Service, Billing Policy, and support information are publicly available at makerflow.io.