Gildix Reply
An eBay production keyset stays disabled until you either apply for an exemption or stand up a Marketplace Account Deletion endpoint. If you store any eBay user data, the exemption is not the honest option.
The exemption states that you do not store eBay user data. If you keep buyer message text or the replies you generated from it, that statement is false and will not survive scrutiny later.
eBay calls your endpoint with a challenge_code. You must return the SHA256 of challengeCode + verificationToken + endpointUrl concatenated in that order, as a raw hex digest. Base64 is rejected, and so is any other ordering.
Notifications carry a signature header. You decode it, take the key id, fetch eBay's public key, and verify. Skipping verification turns your endpoint into a delete button anyone can press. If verification fails, delete nothing and return 412.
SHA256 of challengeCode, verification token and endpoint URL concatenated in that order, returned as raw hex.
If you store any eBay user data, build the endpoint. The exemption is a declaration that you store none.
Gildix Reply watches your marketplace inbox on a server around the clock and drafts every reply from the store policy you wrote yourself. It keeps working while your computer is off, and nothing is sent until you approve it. First 50 replies are free, no subscription.
See Gildix Reply