Nordia keeps listings, inventory and orders in step for sellers who run an Etsy shop alongside other channels. Sellers connect their own shop with OAuth, choose what Nordia may touch, and can disconnect at any time.
Nordia is used by print-on-demand and small-batch sellers who list the same catalogue on Etsy and elsewhere. The work is repetitive and easy to get wrong by hand, so we do it against the API instead.
Sellers write one product record — title, tags, description, variations, images, shipping profile — and Nordia creates or updates the matching Etsy listing. Edits to a group of listings go out as one job with a per-listing result log.
When a unit sells anywhere, the quantity on the Etsy listing is corrected within seconds. Sellers stop cancelling orders for things they no longer have.
New paid orders arrive in a single queue with the buyer's shipping address and personalisation notes. When the parcel ships, the tracking number is written back to the Etsy receipt so the buyer sees it in their Etsy account.
Listing views, favourites and sales are read on a schedule and turned into a plain view of which products earn their place in the shop and which do not.
Order confirmations and shipping notices are sent through the seller's own email provider, from the seller's own domain, only to buyers who have not opted out. Etsy is never used as a sending channel and buyer addresses are never used for marketing lists.
Every call Nordia makes on a seller's behalf is logged with a timestamp, the endpoint, the scope used and the result. Sellers can export the log; support can read it when something looks wrong.
Nordia holds no shop credentials. Each shop is reached through its own OAuth 2.0 token, granted by the shop owner and revocable by them at any time.
From their Nordia account the seller clicks Connect Etsy shop. We send them to etsy.com/oauth/connect with the scopes listed below and a PKCE challenge.
The seller reviews the permission list on Etsy's own consent screen and approves or refuses. Nothing reaches us before they approve.
Etsy returns the authorisation code to our fixed callback at https://nordiatools.com/oauth/etsy/callback. We verify the state value, exchange the code with the PKCE verifier, and store the token encrypted at rest.
Refresh tokens keep the connection alive without asking again. A seller can disconnect in Nordia, or revoke us from their Etsy account, and we delete the token and stop all calls for that shop.
We request the narrowest set that makes the product work. If a feature is switched off for a shop, the calls behind it are never made.
| Scope | Why Nordia needs it | What we never do with it |
|---|---|---|
| listings_r | Read the shop's listings to show them in the catalogue view, detect drift from the seller's master record, and report performance. | Read listings belonging to shops that have not connected. |
| listings_w | Create and update listings and their inventory, images, variations and shipping profiles, from the seller's own product data. | Publish anything the seller has not queued or approved. |
| listings_d | Remove a listing when the seller deletes it in Nordia, so the two sides do not disagree. | Delete anything automatically, in bulk cleanups, or without a confirmation step. |
| shops_r | Read shop id, sections, shipping profiles and return policies so new listings are attached to the right ones. | Read shop data for competitor research or resale. |
| transactions_r | Read paid receipts to build the fulfilment queue: items, quantities, personalisation, ship-by date. | Build buyer profiles, or retain order data after a shop disconnects (30-day deletion). |
| transactions_w | Write the shipment record back to the receipt — carrier and tracking number — when the parcel leaves. | Mark anything shipped that the seller or their fulfiller has not confirmed. |
| address_r | Read the buyer's shipping address to print the label and pass it to the print partner who makes the item. | Store addresses beyond the fulfilment window, or share them with anyone but the print partner for that order. |
| email_r | Read the connecting seller's own account email, to match the Etsy shop to the right Nordia account and send them operational alerts. | Treat it as a buyer address, or add it to any marketing list. |
| profile_r | Read the seller's public profile so the connected shop is labelled correctly in the interface. | Scrape profiles at large. |
On buyer email addresses. The Etsy API has no endpoint for sending a message to a buyer, and we do not ask for one. Where a seller wants to send a shipping notice or a post-purchase email, Nordia uses the buyer address exposed on the receipt only for a transactional message about that order, sent through the seller's own email provider from the seller's own domain, with an unsubscribe link and no marketing use. Access to the buyer address field is requested from Etsy separately and is switched off for a shop until it is granted.
Rate limit discipline is a design constraint here, not an afterthought. The load per connected shop is bounded and predictable.
429 and 5xx, with a circuit breaker that pauses a shop's queue rather than hammering the API.| Content refresh (4× daily) | ~160 calls |
| Order handling | ~3 calls per order |
| Inventory corrections | ~25 calls |
| Listing edits | ~30 calls |
| Typical total | ~250–400 calls |
We publish this figure because it is the number that decides whether our quota request is reasonable. It is measured, not aspirational, and we update it as the product changes.
OAuth access and refresh tokens are encrypted with AES-256 using keys held in a managed secrets store, never written to logs, and deleted the moment a shop disconnects.
Held only while the order is open and for 30 days after fulfilment, then deleted. Buyer addresses are shared with the print partner for that specific order and with no one else.
TLS 1.2 or better on every connection. Production access is limited to named staff with two-factor authentication, and every access is logged.
A seller can ask us to erase everything we hold for their shop. We confirm within 5 business days and complete within 30, backups included.
We do not sell, rent or share Etsy data with advertisers, data brokers or model training pipelines. Aggregate benchmarks, if published, are never traceable to a shop.
If seller or buyer data is exposed we notify affected sellers and security@nordiatools.com is monitored for reports from anyone else.
No. The connection is OAuth 2.0 with PKCE. You sign in on Etsy, not here, and you approve a named list of permissions. We never see your credentials.
No. Writes only happen from a job you queued or a rule you switched on. Every write is in your log with the time, the endpoint and the result.
No, and the Etsy API offers no way to. Any post-purchase email goes out through your own email provider, from your own domain, about a specific order the buyer placed.
All calls for your shop stop immediately, tokens are deleted, and the data we hold for you is erased on the schedule in our privacy policy — or straight away if you ask.
No. Nordia is an independent tool built on the public Etsy Open API. Etsy does not sponsor or endorse it. Etsy is a trademark of Etsy, Inc.