Two separate locks
ConnectMyShop keeps two authorizations apart:
- Etsy → ConnectMyShop. You sign in on Etsy’s own page (OAuth 2.0 with PKCE) and choose which Etsy permissions to grant.
- Your AI → ConnectMyShop. Each AI assistant signs in to ConnectMyShop separately (OAuth 2.1) and gets only the permissions you give it — never more than your Etsy permissions allow.
Your Etsy password never touches ConnectMyShop, and your Etsy access tokens are never given to an AI assistant.
You control how changes are approved
- AI assistants can only propose changes. Each proposal shows an exact before-and-after preview.
- By default, a change runs only after you approve it, only for the shop it belongs to, and only within 24 hours. You can opt into automatic approvals separately for listing edits, prices, new drafts, deactivation and publishing; these actions are still logged.
- If the listing changed on Etsy after the preview was made, the change is stopped so nothing is overwritten by surprise.
- New listings are always created as unpublished drafts. Publishing and deleting are separate permissions, off by default.
Protecting stored data
- All traffic uses HTTPS.
- Etsy tokens are encrypted at rest with authenticated encryption (AES-256-GCM).
- Browser session tokens are stored as one-way hashes. Signing out invalidates your browser session.
- Sign in with Etsy or an optional passkey. We store only the passkey’s public credential data, never its private key or your biometric data.
- We keep only the Etsy data needed to run the Service and refresh or delete cached data quickly.
Limited on purpose
- There is no “call any Etsy endpoint” tool. AI assistants get a small set of specific, reviewed tools.
- Every tool call is checked against both your Etsy permissions and that AI’s own permissions.
- Requests are rate-limited per shop so one assistant can’t overload your shop or the Etsy API.
- Every request, approval and action is recorded in your activity history.
You can always pull the plug
- Revoke a single AI assistant from your dashboard.
- Disconnect your Etsy shop — its tokens are deleted immediately.
- Delete your account and data at any time. See how to delete your data.
Report a vulnerability
Found a security issue? Please email security@connectmyshop.app with the details. We’ll acknowledge within 3 business days and keep you updated. Please don’t access other people’s data or disrupt the Service while testing.