Security

Security Practices

Gifts In Seller Tools is designed around OAuth authorization, least-privilege access, and careful handling of data from my own Etsy shops.

The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc.

Security Controls

The application will not collect Etsy passwords. Access to my own shops must be authorized through Etsy OAuth 2.0.

Refresh tokens are planned to be encrypted at rest and deleted when a shop disconnects or deletion is verified.

Initial scopes should stay limited to approved shop, listing, and order workflow testing needs for my own shops.

The public site and future callback endpoints must load over HTTPS.

Administrative access should be restricted, logged, and reviewed.

The future app should respect Etsy API rate limits and back off when responses require it.