Setting up a production eBay developer account (up to the account del…

Using eBay's APIs in production takes more than writing code: you need a correctly configured developer account and, above all, a working Marketplace Account Deletion endpoint. It is mandatory: without a validated endpoint, eBay will not enable your production keyset. This guide covers the whole path, from registration to the webhook that handles account deletion requests.

Create the developer account

The starting point is developer.ebay.com:

1. register a developer account and accept the API program terms;
2. link (or create) the eBay account that will act as the seller/owner of the app;
3. open the Application Keys section where you manage your keysets.

Keysets: Sandbox vs Production

eBay provides two separate environments, each with its own keyset. Develop and test in Sandbox, then move to production.

Credential	Purpose
App ID (Client ID)	Identifies the application in calls and OAuth
Cert ID (Client Secret)	Secret used to obtain OAuth tokens
Dev ID	Identifies the developer account

Secrets must be stored securely (e.g. a vault, not in code). The production keyset is unlocked only after you configure and validate the account deletion endpoint, described below.

OAuth and RuName

The Sell APIs require OAuth tokens. In short:

• Application token (client credentials) for calls that do not act on behalf of a user;
• User token (authorization code) for operations on a seller's account;
• the RuName (Redirect URL name) and scopes define the consent flow and permissions.

Configure the RuName in the User Tokens section of the keyset: it is used for the redirect after the user grants consent.

Why the account deletion endpoint is required

eBay must ensure that when a user closes or requests deletion of their account, every partner holding their data deletes it. That is why every production application must expose a Marketplace Account Deletion/Closure endpoint that eBay can notify. It is a compliance obligation: no validated endpoint, no production.

The two-part flow

The endpoint must handle two kinds of request:

1. GET verification (challenge): eBay sends a challenge_code to verify you own the endpoint;
2. POST notification: eBay sends the signed account deletion notification, to which you must respond quickly and then process.

1) The challenge verification (GET)

When you save the endpoint in the portal, eBay calls the URL with a GET and a challenge_code parameter. You must compute an SHA-256 hash by concatenating, in this exact order, three values: challengeCode + verificationToken + endpointURL. Then respond with HTTP 200, Content-Type: application/json and the body { "challengeResponse": "<hash>" }.

// Node.js (concept)
const crypto = require('crypto');
const hash = crypto.createHash('sha256');
hash.update(challengeCode + verificationToken + endpointUrl);
const challengeResponse = hash.digest('hex');
// response: 200, application/json, { "challengeResponse": challengeResponse }

Mind the details that cause validation to fail: the endpointURL used in the hash must be exactly the configured URL (same string, including the query if present); the concatenation order is binding; the Content-Type must be application/json.

The verification token is a string you choose, 32–80 characters long, made only of letters, numbers, hyphen (-) and underscore (_). You enter it in the portal and use it in the hash.

2) The deletion notification (POST)

Once verification passes, eBay sends deletion notifications via POST. Two rules are essential:

• Respond immediately with a 2xx code (e.g. 200/204): heavy processing must be asynchronous, not blocking the response;
• Validate the signature in the x-ebay-signature header using eBay's public key (Notification API, getPublicKey endpoint) before trusting the payload.

After validation, identify the user from the identifiers in the payload and delete their data from your systems, logging the operation. Make processing idempotent: the same notification can arrive more than once and must not cause errors or double effects. eBay's Event Notification SDK simplifies signature verification.

Deploy as an AWS Lambda

A serverless endpoint is a natural choice: no servers to manage, HTTPS out of the box and automatic scaling. A typical architecture:

• API Gateway (HTTPS) as the public entry point;
• AWS Lambda handling both the challenge GET and the notification POST;
• the verification token in an environment variable or a secret manager;
• asynchronous processing (e.g. a queue) for the actual data deletion.

A complete, ready-to-use implementation (C#/.NET on Azure Functions) for receiving eBay's account deletion notifications is available here: github.com/Capponi-Ivan-Org/ebay-account-deletion-webhook. The same pattern — challenge verification and signed-notification handling — applies identically to AWS Lambda with API Gateway.

Configure and validate in the eBay portal

1. go to Application Keys → the Marketplace account deletion/closure notifications section;
2. enter the endpoint URL (HTTPS, no internal IPs or localhost);
3. enter the verification token (the same used in your code);
4. provide a contact email for alerts;
5. click Save: eBay immediately sends the challenge and validates the response. If the hash is correct, the endpoint is verified.

Common mistakes

• wrong concatenation order in the hash (must be challengeCode + verificationToken + endpointURL);
• endpointURL in the hash different from the URL saved in the portal;
• response without Content-Type: application/json or with a status other than 200;
• endpoint not public or not on HTTPS;
• POST signature not validated, or a slow response that times out;
• non-idempotent processing with repeated notifications.

Conclusion

Taking an eBay app to production means, beyond credentials and OAuth, exposing a Marketplace Account Deletion endpoint that passes the challenge verification and handles signed notifications reliably. It is a compliance requirement, but also a good opportunity to set up security, idempotency and asynchronous processing from the start. Official documentation: eBay Marketplace Account Deletion.