How to Integrate Lovable with eBay API

Go to developer.ebay.com and sign in with your eBay account. Navigate to the 'My Account' section and select 'Application Access Keys'. Click 'Create a Keyset' and choose 'REST API'. Fill in the Application Title with something like 'Lovable Integration', select the appropriate environment (Sandbox for testing, Production for live use), and click 'Submit'. eBay will generate three credential pairs: App ID (Client ID), Dev ID, and Cert ID (Client Secret). The most important values are the App ID and Cert ID — these are what you will use for OAuth2. eBay also assigns a different App ID for Sandbox vs Production, so keep track of which environment each set belongs to. The Sandbox environment uses the prefix 'SBX-' in its URLs and credentials. If you plan to use Inventory or Fulfillment APIs (which require a user OAuth token, not just an application token), you also need to set up OAuth2 redirect URIs in your eBay application settings under 'User Tokens'. For this guide's Browse API usage, only the Application Token flow is needed and no redirect URI is required.

In your Lovable project, click the '+' icon next to the Preview panel to open the Cloud tab, then locate the Secrets section. Add two secrets for your eBay credentials. Click 'Add Secret' and enter EBAY_CLIENT_ID as the name, then paste your eBay App ID as the value. Add another secret named EBAY_CLIENT_SECRET and paste your Cert ID value. If you are building for the eBay Sandbox first (strongly recommended), also add EBAY_ENVIRONMENT with value sandbox — your Edge Function can use this to switch between https://api.sandbox.ebay.com and https://api.ebay.com base URLs. These secrets are encrypted at rest and only accessible from Edge Functions via Deno.env.get(). Lovable's security system blocks approximately 1,200 hardcoded API keys per day and the SOC 2 Type II certified infrastructure ensures your eBay credentials are handled securely. Never paste your eBay Cert ID in a Lovable chat message or in any frontend code — it must live exclusively in Cloud Secrets.

Ask Lovable to create a Supabase Edge Function that handles eBay's OAuth2 Client Credentials flow to obtain an Application Token, then uses that token to proxy requests to the eBay Browse API. The Edge Function needs to POST to eBay's token endpoint with your Client ID and Client Secret encoded as Base64 Basic Auth, request the 'https://api.ebay.com/oauth/api_scope' scope, and cache the returned access_token for its 7,200-second lifetime. For production implementations, store the token and its expiry in Supabase so you do not request a new token on every function invocation. The Edge Function should then accept an 'endpoint' parameter specifying which eBay API to call (e.g., /buy/browse/v1/item_summary/search) and forward any query parameters. The eBay Sandbox token URL is https://api.sandbox.ebay.com/identity/v1/oauth2/token and the Production URL is https://api.ebay.com/identity/v1/oauth2/token.

1import { serve } from "https://deno.land/std@0.168.0/http/server.ts";
2
3const corsHeaders = {
4  "Access-Control-Allow-Origin": "*",
5  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
6};
7
8let cachedToken: { token: string; expiry: number } | null = null;
9
10async function getEbayToken(): Promise<string> {
11  if (cachedToken && Date.now() < cachedToken.expiry) {
12    return cachedToken.token;
13  }
14
15  const clientId = Deno.env.get("EBAY_CLIENT_ID")!;
16  const clientSecret = Deno.env.get("EBAY_CLIENT_SECRET")!;
17  const env = Deno.env.get("EBAY_ENVIRONMENT") || "sandbox";
18  const tokenUrl = env === "production"
19    ? "https://api.ebay.com/identity/v1/oauth2/token"
20    : "https://api.sandbox.ebay.com/identity/v1/oauth2/token";
21
22  const credentials = btoa(`${clientId}:${clientSecret}`);
23  const response = await fetch(tokenUrl, {
24    method: "POST",
25    headers: {
26      "Authorization": `Basic ${credentials}`,
27      "Content-Type": "application/x-www-form-urlencoded",
28    },
29    body: "grant_type=client_credentials&scope=https%3A%2F%2Fapi.ebay.com%2Foauth%2Fapi_scope",
30  });
31
32  const data = await response.json();
33  if (!response.ok) throw new Error(data.error_description || "eBay token request failed");
34
35  cachedToken = {
36    token: data.access_token,
37    expiry: Date.now() + (data.expires_in - 60) * 1000,
38  };
39  return cachedToken.token;
40}
41
42serve(async (req) => {
43  if (req.method === "OPTIONS") {
44    return new Response("ok", { headers: corsHeaders });
45  }
46
47  try {
48    const env = Deno.env.get("EBAY_ENVIRONMENT") || "sandbox";
49    const baseUrl = env === "production" ? "https://api.ebay.com" : "https://api.sandbox.ebay.com";
50    const token = await getEbayToken();
51
52    const url = new URL(req.url);
53    const endpoint = url.searchParams.get("endpoint") || "/buy/browse/v1/item_summary/search";
54    url.searchParams.delete("endpoint");
55
56    const ebayUrl = new URL(`${baseUrl}${endpoint}`);
57    url.searchParams.forEach((value, key) => {
58      ebayUrl.searchParams.set(key, value);
59    });
60
61    const response = await fetch(ebayUrl.toString(), {
62      headers: {
63        "Authorization": `Bearer ${token}`,
64        "Content-Type": "application/json",
65        "X-EBAY-C-MARKETPLACE-ID": "EBAY_US",
66      },
67    });
68
69    const data = await response.json();
70    return new Response(JSON.stringify(data), {
71      status: response.status,
72      headers: { ...corsHeaders, "Content-Type": "application/json" },
73    });
74  } catch (error) {
75    return new Response(
76      JSON.stringify({ error: error.message }),
77      { status: 500, headers: { ...corsHeaders, "Content-Type": "application/json" } }
78    );
79  }
80});

With the Edge Function deployed, ask Lovable to create a React component that calls the Edge Function to search eBay listings using the Browse API. The Browse API's /buy/browse/v1/item_summary/search endpoint accepts a q parameter for search query, limit for number of results, offset for pagination, and filter for narrowing results by condition, price range, or category. The response contains an itemSummaries array with each item having itemId, title, price (value and currency), condition, image (imageUrl), itemWebUrl (link to eBay listing), and seller information. The component should show a search input, display results as cards with item image, title, price, and condition, and link each card to the live eBay listing. Note that in Sandbox mode, the Browse API returns test data which may appear generic — this is expected behavior.

For order management use cases, you need to extend the integration to use eBay's Fulfillment API with a user OAuth token (not just the application token used for Browse API). The Fulfillment API requires going through eBay's user authorization flow where the seller clicks an authorization URL, grants access to your application, and eBay redirects back with an authorization code you exchange for a user access token. This token grants permission to read and manage that specific eBay seller's orders. Store the user access token and refresh token in Supabase (in a secure table with appropriate RLS policies) rather than in Cloud Secrets, since it belongs to a specific user. Your Edge Function for Fulfillment API calls should read the stored token from Supabase, refresh it if expired using the refresh token and eBay's token endpoint, then call the Fulfillment API. The /sell/fulfillment/v1/order endpoint returns a list of orders with buyer details, line items, pricing, and shipping addresses. Sync these to a Supabase orders table for centralized management and to build order status dashboards.