Permissions Requested
Craftific.com requests only the specific Etsy API permissions needed to provide its features. Here is every scope we request and exactly why:
How the Connection Works
Click "Connect Etsy Shop" in Studio
You initiate the connection from within Craftific.com's Studio or from this page. You must be signed in to Craftific.com first.
Etsy's OAuth page opens
You are redirected to etsy.com — Craftific.com never sees your Etsy password or login credentials. Etsy shows you exactly which permissions are being requested.
You approve (or decline) the permissions
You see every permission being requested and choose to approve or decline. No data is accessed until you approve. You can approve all or decline entirely.
Etsy sends an authorisation code to our proxy
Etsy redirects to tf-proxy.ashutoshpatney1.workers.dev/etsy/callback. The Cloudflare Worker exchanges the code for an access token — never in your browser.
Token stored securely, shop synced
Your Etsy access token is stored encrypted in your Supabase account. Craftific.com then pulls your shop listings and you see your Shop Dashboard.
You control all actions
Craftific.com never modifies your Etsy listings without your explicit instruction. Every write action (update tag, push listing) requires you to click a button. Nothing is automatic.
🔒 Security & Data Handling
- Your Etsy OAuth access token is stored encrypted in Supabase — never in your browser or in plain text on any server.
- Craftific.com uses PKCE (Proof Key for Code Exchange) for the OAuth flow — the most secure OAuth 2.0 method available.
- API calls to Etsy are proxied through our Cloudflare Worker — your token is never exposed to browser-side JavaScript.
- Craftific.com accesses your Etsy data only when you initiate a specific action within the Studio.
- We do not store copies of your Etsy listing data on our servers — data is fetched fresh on each session and kept in your browser only.
- To revoke access: go to Etsy → Account → Security → Apps with Access and remove Craftific.com. Your token in our system is automatically invalidated.
Frequently Asked Questions
No. Craftific.com does not take any action on your Etsy shop automatically. Every write action (creating or updating a listing) requires your explicit instruction — you click a "Push to Etsy" or "Update listing" button. There is no background automation.
Yes. You can disconnect in two ways: (1) from Craftific.com's Settings → Connected Accounts → Disconnect Etsy, or (2) directly from Etsy at etsy.com → Account → Security → Apps with Access. Either method immediately revokes Craftific.com's access to your shop.
No. Craftific.com does not request and cannot access your Etsy Payments balance, bank account details, payout history, or any financial account information. The permissions we request are limited to listings, shop info, transactions (order count only), and profile.
We recommend against using Craftific.com on shared or public computers. Your Craftific.com session (via Supabase auth) is what controls Etsy access — anyone who accesses your Craftific.com account can potentially act on your Etsy shop through Craftific.com. Sign out of Craftific.com when using shared devices.
No. Connecting Etsy to Craftific.com is a standard API integration that does not interact with Etsy's Star Seller metrics. Etsy's Star Seller programme measures your shop's response rate, dispatch rate, and reviews — Craftific.com does not interact with or modify any of these.