Security
Designed around separate accounts and minimum access.
Security controls must be verified in the production integration before seller connections are opened.
Production requirements
- TLS for all browser and server traffic;
- one-way salted password hashes and HttpOnly session cookies;
- OAuth tokens encrypted at rest and never exposed to browser code;
- separate token and data ownership for each user and connected shop;
- OAuth state validation, PKCE S256 and exact redirect URI matching;
- secret redaction from application logs and support responses;
- rate limiting, bounded request bodies and clear API error reporting.
Credentials Flowikka will never request from a seller
An Etsy password, Etsy developer API key, shared secret or another application’s OAuth token.
A public security page is not a substitute for implementation. These controls must exist in the deployed product before Flowikka describes them as active safeguards.