Connecting any third-party tool to a shop is a real decision, and the honest way to present it is scope by scope rather than as a single "connect" button. Shop Pilot’s hosted connection uses Etsy’s OAuth 2.0 flow over HTTPS with PKCE and short-lived, single-use state. You sign in only on Etsy’s own authorization page — Shop Pilot never receives or stores an Etsy password. Every scope named below is defined in Etsy’s scope reference, so this list can be checked rather than taken on trust.
The scopes requested
| Scope | What it is for |
|---|---|
| listings_r | Read listing details and status — previews, editing, duplicate protection, draft review, registry history, and analytics. |
| listings_w | Create and update listings, upload seller-authorized images and digital files, and publish when explicitly requested. |
| listings_d | Delete a seller-selected listing, after a destructive confirmation. |
| shops_r | Read basic shop information, sections, and identity, so actions target the intended shop. |
| shops_w | Create shop settings you explicitly ask for — copying shipping profiles, return policies, processing profiles and sections from one connected shop into another. Never used to change or delete a setting that is already there. |
| transactions_r | Read paid receipts and transaction details for analytics and, when the seller enables it, fulfilment — including the order and delivery information that workflow needs. |
| address_r | Read the delivery address on a paid order, only to complete an order you asked Shop Pilot to send to your supplier. |
| transactions_w | Add a tracking number to a paid order in your own shop once the print partner ships it, so the buyer is notified. Used only for an order whose fulfilment you started here. |
What permissions does Shop Pilot not request?
It does not request cart, favorites, billing-write, or payment-write permissions. Shop Pilot does not process buyer checkout payments and does not collect Etsy passwords.
This is worth stating plainly because scope lists are usually where a tool quietly asks for more than its features need. A listing tool has no reason to hold write access to your billing, and the two write scopes it does hold are each tied to one thing you asked for: copying a shop setting between your own shops, and putting a tracking number on your own order.
Why does a listing tool need write access?
Because creating a listing is itself a write operation. Creating a draft, attaching generated mockups, and setting title, tags, description, and attributes are all writes against the Etsy Open API; there is no read-only path that produces a listing. The mitigation is not to avoid the scope — it is to make publishing an explicit step you choose, which is why every batch can stop at a draft for you to check first.
Ending the connection
Disconnecting is available in Account & Privacy. It deletes the stored Etsy tokens and stops future Etsy API calls. Separately — and independently of Shop Pilot — the grant can be revoked in Etsy’s own connected-app settings. Two independent off switches is the correct arrangement: revoking access should never require the cooperation of the tool you are revoking.
The current scope list is maintained on Etsy permissions. What the listing and order permissions are used for, step by step, is on Etsy listing automation and Etsy order automation.