How the Etsy app works
Updated 22 October 2026
JERSEY Wood Store has one private app that talks to the Etsy Open API. It is wired to a single shop, JERSEYwoodStore, and the shop owner is its only user.
The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.
What kind of app this is
It is a private tool, not a product. There is no sign-up, nobody else can add their shop, and it is not offered to other sellers. If that were ever to change, we would first ask Etsy for the right kind of access and rewrite this page.
What it does
- Reads the shop profile and sections, so it always works on the right shop.
- Reads our own listings, with prices and stock, so our records match Etsy.
- Changes our own listings when the owner asks: titles, descriptions, tags, prices, quantities.
- Reads our own orders so they can be built, packed and shipped on time.
What it does not do
- It does not touch any other shop and collects nothing about other sellers or buyers.
- It does not scrape Etsy. It only calls the official API.
- It does not send messages to buyers. Order talk stays inside Etsy.
- It does not sell or share Etsy data, does not feed advertising or marketing platforms, does not run analytics and does not train AI models.
Permissions
| Scope | Why we ask for it |
|---|---|
shops_r |
Read the shop profile and sections to confirm which shop is connected. |
listings_r |
Read our own listings, prices and stock. |
listings_w |
Update our own listings when the owner decides to. |
transactions_r |
Read our own orders for fulfilment. |
How the connection is made
- The owner opens the private connect page on this site and signs in with the owner password.
- The owner ticks the box accepting the app terms and the privacy policy. We store the time and the terms version.
- The browser goes to Etsy, where the owner approves the four scopes. The flow is OAuth 2.0 with PKCE, and Etsy returns the owner to
https://jerseywoodstore.com/connect/etsy/return. The pending request is valid for ten minutes. - The site swaps the one-time code for tokens. If they belong to any Etsy account other than the owner's, they are dropped.
How tokens are protected
Access and refresh tokens are encrypted with AES-256-GCM before they are saved. The key lives separately as a secret. The status page tells the owner whether the shop is connected but never prints a token. A saved access token older than an hour is renewed before it is used.
Turning it off
Remove the app from the connected apps in your Etsy account settings and its access ends at once. The owner can also use the disconnect button on the status page, which deletes the stored tokens.
Trademark
The term 'Etsy' is a trademark of Etsy, Inc. This Application uses Etsy's API, but is not endorsed or certified by Etsy.
Questions go to hello@jerseywoodstore.com.