How to Integrate Replit with Etsy API

1// check-etsy-secrets.js
2const required = ['ETSY_CLIENT_ID', 'ETSY_REDIRECT_URI', 'ETSY_SCOPES'];
3for (const key of required) {
4  if (!process.env[key]) {
5    throw new Error(`Missing secret: ${key}. Set it in Replit Secrets (lock icon 🔒).`);
6  }
7}
8console.log('Etsy config OK.');
9console.log('Client ID:', process.env.ETSY_CLIENT_ID);
10console.log('Scopes:', process.env.ETSY_SCOPES);

1// etsy.js — Etsy OAuth 2.0 PKCE + API integration for Node.js on Replit
2const express = require('express');
3const axios = require('axios');
4const crypto = require('crypto');
5
6const app = express();
7app.use(express.json());
8
9const CLIENT_ID = process.env.ETSY_CLIENT_ID;
10const REDIRECT_URI = process.env.ETSY_REDIRECT_URI;
11const SCOPES = process.env.ETSY_SCOPES || 'listings_r transactions_r shops_r';
12
13// In-memory store for PKCE verifiers (use Redis/DB in production)
14const pkceStore = {};
15
16function generateCodeVerifier() {
17  return crypto.randomBytes(32).toString('base64url');
18}
19
20function generateCodeChallenge(verifier) {
21  return crypto.createHash('sha256').update(verifier).digest('base64url');
22}
23
24// Step 1: Start OAuth — generate PKCE and redirect to Etsy
25app.get('/auth/login', (req, res) => {
26  const codeVerifier = generateCodeVerifier();
27  const codeChallenge = generateCodeChallenge(codeVerifier);
28  const state = crypto.randomBytes(16).toString('hex');
29  
30  // Store verifier for later (use session store in production)
31  pkceStore[state] = codeVerifier;
32  
33  const params = new URLSearchParams({
34    response_type: 'code',
35    redirect_uri: REDIRECT_URI,
36    scope: SCOPES,
37    client_id: CLIENT_ID,
38    state,
39    code_challenge: codeChallenge,
40    code_challenge_method: 'S256'
41  });
42  
43  res.redirect(`https://www.etsy.com/oauth/connect?${params}`);
44});
45
46// Step 2: OAuth callback — exchange code for tokens
47app.get('/auth/callback', async (req, res) => {
48  const { code, state } = req.query;
49  const codeVerifier = pkceStore[state];
50  
51  if (!codeVerifier) return res.status(400).send('Invalid state parameter');
52  delete pkceStore[state];
53  
54  try {
55    const tokenResponse = await axios.post('https://api.etsy.com/v3/public/oauth/token', {
56      grant_type: 'authorization_code',
57      client_id: CLIENT_ID,
58      redirect_uri: REDIRECT_URI,
59      code,
60      code_verifier: codeVerifier
61    });
62    
63    const { access_token, refresh_token, expires_in } = tokenResponse.data;
64    // In production: store tokens securely in database
65    // For single-user tool: update ETSY_ACCESS_TOKEN in Secrets manually
66    console.log('OAuth complete. Access token expires in:', expires_in, 'seconds');
67    res.json({ success: true, expires_in });
68  } catch (err) {
69    res.status(500).json({ error: err.response?.data || err.message });
70  }
71});
72
73// Get current user's shop info (requires OAuth token)
74app.get('/api/shop', async (req, res) => {
75  const token = process.env.ETSY_ACCESS_TOKEN;
76  try {
77    const response = await axios.get('https://openapi.etsy.com/v3/application/users/me/shops', {
78      headers: { 'Authorization': `Bearer ${token}`, 'x-api-key': CLIENT_ID }
79    });
80    res.json(response.data);
81  } catch (err) {
82    res.status(err.response?.status || 500).json({ error: err.response?.data || err.message });
83  }
84});
85
86// Search public listings by keyword (API key only, no OAuth needed)
87app.get('/api/listings/search', async (req, res) => {
88  const { keywords, limit = 25 } = req.query;
89  try {
90    const response = await axios.get('https://openapi.etsy.com/v3/application/listings/active', {
91      headers: { 'x-api-key': CLIENT_ID },
92      params: { keywords, limit }
93    });
94    res.json(response.data);
95  } catch (err) {
96    res.status(err.response?.status || 500).json({ error: err.response?.data || err.message });
97  }
98});
99
100app.listen(3000, '0.0.0.0', () => console.log('Etsy server running on port 3000'));

1# etsy_api.py — Etsy Open API v3 with OAuth 2.0 PKCE for Python on Replit
2import os
3import hashlib
4import base64
5import secrets
6import requests
7from flask import Flask, request, redirect, jsonify, session
8
9app = Flask(__name__)
10app.secret_key = secrets.token_hex(32)  # Set SECRET_KEY in Secrets for production
11
12CLIENT_ID = os.environ['ETSY_CLIENT_ID']
13REDIRECT_URI = os.environ['ETSY_REDIRECT_URI']
14SCOPES = os.environ.get('ETSY_SCOPES', 'listings_r transactions_r shops_r')
15
16def generate_pkce():
17    """Generate PKCE code verifier and S256 challenge."""
18    verifier = secrets.token_urlsafe(43)
19    challenge = base64.urlsafe_b64encode(
20        hashlib.sha256(verifier.encode()).digest()
21    ).rstrip(b'=').decode()
22    return verifier, challenge
23
24@app.route('/auth/login')
25def login():
26    verifier, challenge = generate_pkce()
27    state = secrets.token_hex(16)
28    session['pkce_verifier'] = verifier
29    session['oauth_state'] = state
30    
31    params = {
32        'response_type': 'code',
33        'redirect_uri': REDIRECT_URI,
34        'scope': SCOPES,
35        'client_id': CLIENT_ID,
36        'state': state,
37        'code_challenge': challenge,
38        'code_challenge_method': 'S256'
39    }
40    auth_url = 'https://www.etsy.com/oauth/connect?' + '&'.join(f'{k}={v}' for k, v in params.items())
41    return redirect(auth_url)
42
43@app.route('/auth/callback')
44def callback():
45    code = request.args.get('code')
46    state = request.args.get('state')
47    
48    if state != session.get('oauth_state'):
49        return 'Invalid state', 400
50    
51    verifier = session.pop('pkce_verifier', None)
52    if not verifier:
53        return 'Missing PKCE verifier', 400
54    
55    response = requests.post('https://api.etsy.com/v3/public/oauth/token', json={
56        'grant_type': 'authorization_code',
57        'client_id': CLIENT_ID,
58        'redirect_uri': REDIRECT_URI,
59        'code': code,
60        'code_verifier': verifier
61    })
62    
63    if not response.ok:
64        return jsonify({'error': response.json()}), response.status_code
65    
66    tokens = response.json()
67    # Store tokens securely — update Secrets or save to database
68    print('Access token received, expires in:', tokens['expires_in'], 'seconds')
69    return jsonify({'success': True, 'expires_in': tokens['expires_in']})
70
71@app.route('/api/receipts')
72def get_receipts():
73    """Get shop orders (requires OAuth token with transactions_r scope)."""
74    token = os.environ.get('ETSY_ACCESS_TOKEN')
75    if not token:
76        return jsonify({'error': 'ETSY_ACCESS_TOKEN not set — run OAuth flow first'}), 401
77    
78    # First get shop ID
79    me_resp = requests.get(
80        'https://openapi.etsy.com/v3/application/users/me/shops',
81        headers={'Authorization': f'Bearer {token}', 'x-api-key': CLIENT_ID}
82    )
83    if not me_resp.ok:
84        return jsonify({'error': 'Failed to get shop info'}), me_resp.status_code
85    
86    shop_id = me_resp.json()['shop_id']
87    receipts_resp = requests.get(
88        f'https://openapi.etsy.com/v3/application/shops/{shop_id}/receipts',
89        headers={'Authorization': f'Bearer {token}', 'x-api-key': CLIENT_ID},
90        params={'limit': 25, 'was_paid': True}
91    )
92    return jsonify(receipts_resp.json())
93
94if __name__ == '__main__':
95    app.run(host='0.0.0.0', port=3000)