Consigner Connect

Securely captures marketplace sessions for validation by Consigner.

Consigner Connect links Chrome to your own Consigner workspace. It acts only when your Consigner portal asks, and it reads nothing from a marketplace until you confirm in this extension's popup. INSTALL CHECK When your Consigner portal asks, the extension answers a one-time random challenge so Consigner knows the add-on is installed. No cookies or account data are read for this step. CONNECT A MARKETPLACE Consigner uses the extension to connect marketplaces such as Whatnot, StockX and Alias; eBay connects through eBay's own sign-in inside Consigner and does not need it. When you start a connection in Consigner and click "Grant permission & capture", Chrome asks you to allow access to that one marketplace if you have not already. The extension then reads the cookies that marketplace has set in this browser (the cookies on its own domains are what keep you signed in) and sends the unexpired ones over HTTPS to your Consigner workspace. They go only to Consigner and are never returned to any web page. STOCKX The StockX seller hub (pro.stockx.com) signs its own requests with a short-lived access token. When you connect StockX with your seller-hub tab open, the extension watches that tab for one of the seller hub's own requests to StockX and copies two of its request headers: the access token and the client name. If none appears within about eight seconds, it opens the StockX active-selling page in that same tab once and watches for at most twelve seconds more. It reads no request body and no response, makes no request to StockX of its own beyond that one page load, and removes its watcher as soon as it has both values or the time is up. The token and client name are sent to Consigner with the capture and are never kept in extension storage. If no seller-hub tab is open or no token is found, nothing is sent and the popup asks you to open your StockX seller hub and try again. REFRESHING A SESSION If Consigner asks for a fresh session (for example when a StockX token is close to expiring), you confirm it in the popup with the same "Grant permission & capture" button and the same steps run again. Nothing is refreshed without your click. RECORDING A LISTING ACTION If Consigner asks you to show it how an action works on a marketplace such as StockX or Alias, you click "Grant permission & start observing" and perform the action once yourself: list an item, change a price, remove a listing, or load your listings, orders or offers. While recording, the extension watches only that marketplace's own requests of the kind the action uses (changes for a listing action, reads for a load) and keeps their shape: the method, the address with identifiers replaced by placeholders, the names of the request headers, an outline of the body in which values become placeholders, and the response status, content type and the names and types of its fields. It keeps no cookie, no authorization header value and no response values. Apart from the address pattern, the only values kept as written are true, false, null, short one-word lowercase codes such as new or usd, and the values of four plain headers (accept, accept-language, content-type, x-requested-with) when they are simple codes. Free text, numbers, long values and anything credential-shaped always become placeholders, and a record that still contains a credential-shaped string is refused whole. Recording ends by itself when a page goes three seconds without a new recorded request after recording one (the action is done), when a page reaches twenty recorded requests, or when the fifteen-minute window Consigner opened for the recording closes; Send and Discard end it at once. Send, Discard, the three-second stop and the twenty-request stop are pushed to every open tab of that marketplace, and once the window has closed no tab records anything. At most twenty request shapes are kept, you see the list in the popup, and nothing is sent until you press Send; Discard throws it all away. WHAT IT NEVER DOES The extension never asks for your password or two-factor codes; you type those only on the marketplace's own website. It never creates, changes or deletes a cookie, sends what it collects only to Consigner, and never runs on a site you have not granted. Consigner never moves money, never changes passwords and never reads direct messages. You can disconnect any marketplace from Consigner's connection controls; disconnecting revokes the stored session. Chrome always asks you to complete installation; a web page cannot install Consigner Connect silently.