Etsy

This connector uses the Etsy Open API v3 (developers.etsy.com). You authorize it once, in AnythingMCP; from then on the short-lived access token (1 hour) is renewed automatically, and the refresh token Etsy replaces on every renewal is stored for you.

Setup:

1. Register an app at https://www.etsy.com/developers/your-apps → Create New App.
2. In the app's settings, add this callback URL: https://cloud.anythingmcp.com/api/mcp-oauth/callback on AnythingMCP Cloud, or <your AnythingMCP server URL>/api/mcp-oauth/callback when you host AnythingMCP yourself. Etsy compares it character for character (https, upper/lower case, no trailing slash).
3. Note the app's Keystring and Shared secret. Enter them as ETSY_CLIENT_ID and ETSY_CLIENT_SECRET, leave ETSY_REFRESH_TOKEN empty, and install.
4. Open the connector and click Authorize with Provider. Sign in to Etsy, approve, and you land back on the connector page with the tools ready. AnythingMCP runs Etsy's OAuth2 PKCE flow (S256) for you.

Scopes: the connector asks for email_r shops_r listings_r listings_w transactions_r transactions_w: read your account, shops, listings and orders, edit listings, and add tracking to orders. It cannot delete listings. Connectors installed before October 2026 asked only for the read scopes: to use the write tools, open the connector's OAuth settings, set the scopes above and click Authorize with Provider again; until then Etsy answers "Access token lacks scope".

Already have a refresh token? You can paste it into ETSY_REFRESH_TOKEN instead of step 4, if you obtained it yourself through Etsy's OAuth2 PKCE flow for the same app. Connectors set up that way keep working as they are; there is nothing to do. Clicking Authorize with Provider on one replaces its token with a new one, and needs the callback URL from step 2.

Authentication: the connector attaches both headers on every request:

• Authorization: Bearer <auto-refreshed access token>
• x-api-key: ${ETSY_CLIENT_ID}:${ETSY_CLIENT_SECRET}

Etsy requires the API key on every request, OAuth or not, and it must carry the Keystring AND the Shared secret separated by a colon. The Keystring alone earns a 403 {"error":"Invalid API key: should be in the format 'keystring:shared_secret'."} on every call.

The access token is kept in memory and written back, together with the rotated refresh token, into this connector's own encrypted configuration, so a restart does not lose it. Per Etsy's policy, refresh tokens rotate on each use; AnythingMCP stores the new one from every refresh response and re-uses it automatically.

If a call says the access token could not be renewed: an Etsy refresh token works once and expires after 90 days unused. Click Authorize with Provider on the connector page to get a new one.

Shop ID: every account has a shop_id. Get it from etsy_get_authenticated_user then etsy_get_user_shops.

Pagination: ?limit=N&offset=M (limit max 100).

Rate limits: 10k req/24h per app. On 429 back off.

Creating a listing takes a few steps, in this order: find the category with etsy_list_seller_taxonomy; for a physical item get a shipping profile (etsy_list_shipping_profiles), a processing profile (etsy_list_processing_profiles) and, outside the EU, a return policy (etsy_list_return_policies); create the draft with etsy_create_listing_draft; add at least one photo with etsy_add_listing_image; publish with etsy_edit_listing and state=active. Change price or stock with etsy_read_listing_inventory then etsy_set_listing_inventory, which replaces the whole inventory. Etsy rejects titles with more than three words in capitals and tags longer than 20 characters; a shop on vacation cannot change listings.

Out of scope here: deleting listings, payment account, billing, taxonomy edits.