When a third-party tool asks for eBay OAuth permissions, the consent screen shows raw scope URLs that mean nothing to most sellers. Some tools ask for scopes they don't need — read-only monitor tools requesting write permissions is a red flag. This post is the plain-English translation of every OAuth 2.0 scope eBay publishes, ranked by risk, with concrete examples of what each one enables.
Why OAuth 2.0 replaced Auth'n'Auth
eBay's old Auth'n'Auth token system granted apps full seller-level access with a single opaque token. OAuth 2.0 introduced scopes — granular permissions where the seller sees exactly what the app can access before authorizing.
Modern eBay tools should use OAuth 2.0. If a tool still uses Auth'n'Auth (they'd redirect you to eBay's legacy auth page instead of the OAuth consent screen), that's a maintenance signal — the tool hasn't been updated since 2018+.
Read-only scopes
These grant view access without mutation. Legitimate monitor tools should only need these.
sell.inventory.readonly — Read your active listings, quantities, and stock levels. Needed for repricers to see what you have listed.
sell.marketing.readonly — Read your promotions (Markdown Manager sales, Promoted Listings campaigns). Needed for reporting tools.
sell.fulfillment.readonly — Read your orders, tracking, and shipment status. Needed for order-management tools.
sell.account.readonly — Read account-level settings, feedback, and metrics. Low-risk read.
sell.analytics.readonly — Read Traffic Reports, sales analytics, seller performance metrics. Needed for analytics dashboards.
Write scopes
These grant mutation access. Only automation tools that actively change data need these.
sell.inventory — Full write access to inventory. Repricers need this to change prices; listing tools need it to create/update listings.
sell.marketing — Full write access to promotions. Markdown-sale automation needs this.
sell.fulfillment — Full write access to orders (mark shipped, cancel, refund). Order-processing tools need this.
sell.account — Full write to account settings. Rarely needed by third-party tools — be suspicious if requested.
The full list — plain English
commerce.identity.readonly — Read your eBay username and basic profile. Needed by literally every OAuth app.
buy.order.readonly — Read buyer-side orders (you as buyer). Usually not needed for seller tools.
buy.item.bulk — Batch item lookups. Some price-comparison tools use this.
sell.finances — Read financial data (payouts, transactions, fees). Bookkeeping integrations need this.
sell.reputation — Read feedback data. Analytics tools use this.
sell.stores — Read store subscription details. Rare.
sell.item.draft — Write access to drafts. Listing tools use this.
sell.item — Full write to items (legacy Trading API items). Older repricers use this.
Red flags — scopes no legitimate tool should ask for
If a repricer asks for these, something's off:
sell.account(write) — repricers never need to modify your account settingscommerce.identity(write) — no tool should be able to change your identity- Any scope prefixed
buy.for a seller tool — you're the seller, buyer scopes are unrelated
Read-only variants of these are usually fine (identity read is standard). Write variants on non-obvious scopes are worth questioning.
How to revoke scope grants
Seller Hub → Account → Site Preferences → Third-Party Access. You'll see every app you've granted OAuth to and can revoke individual grants without deleting the app entirely. Revoking clears the tokens; the app can request re-authorization the next time you use it, giving you a chance to review scopes again.
eBay also expires tokens on inactivity. If you granted access to a tool 18+ months ago and haven't used it, the token has probably auto-expired.
Reading eBay's Developer console yourself
eBay Developer Portal at developer.ebay.com publishes the full OAuth scope reference. Bookmark the scope-list page for verification when new tools request access. Documentation drifts occasionally; the official source is authoritative.
Profitio requests only the scopes needed for the features you enable — see our consent screen preview before signing up.