For an agency running client shops, shared access went live sep 22 and operators just join each shop as declared team members so there's nothing to isolate. Open api v3 works the same way, which makes create_profile, launch_profile and assign_proxy pointless, and since there's no messages endpoint a team member just answers buyers in the app

The official route still has friction, fixed permissions, five team members max, personal api keys limited to five shops and nothing for phone verification or captcha, which is probably why setups like this exist. I'd want a source on most Etsy bans starting on mobile tho