Approved Seller App nexora-studio-publisher returns HTTP 403 before OAuth despite active rate limit

[vyronashop-blip]

Confirmation

• I confirm this post does NOT contain sensitive data for my account.

Question / discussion

Problem

Our Etsy Seller App is shown as Approved in the Developer Portal and has an assigned rate limit, but Etsy's Open API backend rejects the application credentials before OAuth can begin.

App details

• App name: nexora-studio-publisher
• Developer Portal app record ID: 1504096018491
• Keystring: njlo…aov8 (full value intentionally withheld from this public post)
• Portal status: Approved
• Rate limit: 10 QPS / 10K QPD
• Shop: NexorifyCo
• Registered callback: https://localhost:3003/oauth/callback
• Client: NEXORA Studio RC3 ULTIMATE on Windows
• First confirmed: August 14, 2026, 13:59–14:06 Asia/Jerusalem

Read-only diagnostic

Before starting OAuth, the client performs:

GET https://openapi.etsy.com/v3/application/openapi-ping
x-api-key: <keystring>:<shared_secret>

The implementation sends the keystring and shared secret from the same approved app in the required keystring:shared_secret format.

Etsy consistently returns:

HTTP 403
{"error":"API key not found or not active, or incorrect shared secret for API key."}

The keystring was compared character-by-character with the Developer Portal and matches exactly. No OAuth authorization, token exchange, or listing operation is attempted after the preflight fails.

Why this appears to be a provisioning mismatch

The Developer Portal says:

• Approved
• Rate limit assigned: 10 QPS / 10K QPD
• Callback URI registered

But the Open API backend says the app key is not found or not active. Because the public ping fails before OAuth, this is not caused by the callback URI, scopes, user token, or listing permissions.

This matches recent reports in:

• Etsy app approved in Developer Portal, but OAuth says “application not recognized” and openapi-ping returns 403 #1690
• Approved seller app unusable — request deletion of the app record so I can re-register #1688

Request

Could Etsy Open API Support please:

1. Confirm whether this application record is active in the API backend.
2. Re-sync or re-provision the approved app in the Open API/OAuth systems.
3. Confirm whether any internal restriction or additional activation step is blocking the key.

The shared secret, OAuth tokens, and authorization codes have not been included in this public report.

[openapi-support[bot]]

Thank you for your report. This bug has been fixed and your App and key should be working now.