Credential model
We never hold your marketplace login
Not your password, and not a copy of your logged-in session. There is no box in FlipDesk where you type your Poshmark password, because there is nowhere for it to go. The only password we ever hold is the one for your GradeThread account.
That is a structural choice, not a policy we could quietly change. For marketplaces that publish a seller API we use their own approval flow. For the ones that do not, the listing is filled in by an extension running in your browser, and our database physically refuses to store a row carrying a password or a cookie.
Two kinds of marketplace, two ways in
Which one applies is decided by the marketplace, not by us. Some publish a seller API and some do not, and that single fact determines what any tool in this category has to ask you for.
Marketplaces with a real seller API
You approve access on the marketplace's own site and it hands us a scoped token. Your password is typed into their login page, never into ours, and you can revoke us from your marketplace account without changing it. We hold the token, encrypted, and nothing else.
Applies to: eBay, Etsy, Depop, Shopify, Whatnot
Marketplaces with no seller API
There is no token to issue, so the work happens in your browser instead of on our servers. Our extension takes the draft we prepared and fills the marketplace's own form in the tab you are already signed in to. Your session never leaves your machine, because the extension never reads it.
Applies to: Poshmark, Mercari, Grailed, Vinted, Facebook Marketplace
The three ways a tool can list on Poshmark
Poshmark, Mercari, Depop and Whatnot publish no seller API. Every tool that lists to them picks one of these, and the choice is the whole security story. It is worth knowing which one your current tool made.
| How it connects | Holds your credential? | Computer must be on? |
|---|---|---|
| You give the tool your marketplace password | Yes, permanently, until you change it | No |
| The tool copies your session out of your browser and replays it from its servers | Yes, a live logged-in session, until it expires | No |
| An extension fills the form inside your own browser | No | Yes, for those marketplaces |
We took the third one. It is the slower answer, and it is the only one that makes the sentence at the top of this page literally true.
Enforced, not promised
A privacy promise is worth what the code behind it is worth. Three things make this one hold whether or not anyone remembers it.
- The extension cannot read a cookie
- A browser extension must declare every permission it uses, and the list is shown to you before you install. Ours does not declare cookie access. Not restricted, not carefully used: absent. The browser itself would refuse the call.
- The database rejects the write
- The queue carrying listing jobs to your browser has a constraint that refuses any job whose contents include a password, a cookie, a session or a token, at any depth and under any spelling. A change that tried to send one would fail at the write, not at review.
- Marketplace tokens are encrypted and revocable
- The OAuth tokens we do hold are encrypted at rest and bound to your account, so one cannot be replayed under a different account. You revoke them from the marketplace, not from us, which means you never have to trust our delete button.
Questions worth asking us
- So GradeThread holds nothing at all?
- That would not be true, so we will not say it. For eBay, Etsy, Depop, Shopify and Whatnot we hold an OAuth token, encrypted at rest and tied to your account, because that is the only way to list while your computer is off. What we never hold is a password or a session cookie for any marketplace, and you can revoke a token from the marketplace side at any time without touching your password.
- What is wrong with a tool storing my marketplace password?
- Two things. A password is not scoped and does not expire, so whoever holds it can do everything you can do for as long as it works, including changing your account details. And logging out does not stop them, because they can log straight back in. A session cookie is better on both counts, but it is still a bearer token: anyone holding it acts as you until it expires.
- Why does passwordless not always mean what it sounds like?
- Some tools connect through an extension that reads your live marketplace session out of your browser and sends it to their servers. No password changes hands, which is a genuine improvement. But their servers are then holding a fully privileged session to your account, and they act from their data centre rather than from your home connection, which is what triggers the unusual-login lockouts sellers report. Ask any tool what its extension does with your cookies.
- How would I check that you are telling the truth?
- Read our extension's permission list before you install it. A browser extension has to declare every permission it uses, and cookie access is one of them. Ours does not ask for it, which means it could not read a session even if the code tried.
- What does this cost me?
- For Poshmark, Mercari, Grailed, Vinted and Facebook Marketplace, your browser has to be open when a queued job runs, because your browser is where the credential lives. A tool holding your session can post at three in the morning and we cannot. That is the trade, and it is the only honest version of it.
List where you already are, without handing over the keys
FlipDesk grades the garment, writes the listing and posts it. Ask any other tool what its extension does with your cookies before you install it.