Etsy connector: x-api-key header omits Shared Secret, causes 403 "Shared secret is required"

[tashage]

Description

Describe the bug
The built-in "Etsy Open API v3" connector fails on every request with:

403 Forbidden
{"error": "Shared secret is required in x-api-key header"}

Steps to reproduce

1. Registered an app on Etsy's developer portal, confirmed Keystring and Shared Secret are correct against Etsy's "Your Apps" page.
2. Completed the Etsy OAuth2 PKCE flow manually and obtained a valid refresh token.
3. Set ETSY_CLIENT_ID, ETSY_CLIENT_SECRET, and ETSY_REFRESH_TOKEN exactly as the connector's own setup instructions describe.
4. Called any tool (e.g. etsy_get_authenticated_user) — always fails with the 403 above.

Root cause (found in the Connector Details page)
Under "Authentication", the connector's own documentation states it sends:

x-api-key: ${ETSY_CLIENT_ID}

Etsy's API requires this header to contain both the Keystring and Shared Secret together, separated by a colon (keystring:sharedsecret), on every request. Since the Shared Secret is never included, Etsy rejects every call.

Expected behavior
The header should be built as:

x-api-key: ${ETSY_CLIENT_ID}:${ETSY_CLIENT_SECRET}

Additional context
Same Connector Details page also shows two other notices that may be related:

• "No authorization URL configured for this connector"
• Healthcheck failing on path "/" (404) — Etsy has no root handler; a working healthcheck endpoint would be /openapi-ping.

Environment

• Using the hosted cloud.anythingmcp.com (free trial), not self-hosted
• Connector: Etsy Open API v3 (REST, Auth Type: OAUTH2)

Happy to provide screenshots if useful.

Steps to Reproduce

1. Registered an app on Etsy's developer portal, confirmed Keystring and Shared Secret are correct against Etsy's "Your Apps" page.
2. Completed the Etsy OAuth2 PKCE flow manually and obtained a valid refresh token.
3. Set ETSY_CLIENT_ID, ETSY_CLIENT_SECRET, and ETSY_REFRESH_TOKEN exactly as the connector's own setup instructions describe.
4. Called any tool (e.g. etsy_get_authenticated_user) — always fails with the 403 above.

Root cause (found in the Connector Details page)
Under "Authentication", the connector's own documentation states it sends:

x-api-key: ${ETSY_CLIENT_ID}

Etsy's API requires this header to contain both the Keystring and Shared Secret together, separated by a colon (keystring:sharedsecret), on every request. Since the Shared Secret is never included, Etsy rejects every call.

Expected Behavior

The header should be built as:

x-api-key: ${ETSY_CLIENT_ID}:${ETSY_CLIENT_SECRET}

### Actual Behavior

403 Forbidden
{"error": "Shared secret is required in x-api-key header"}

### Connector Type

REST

### Deployment Method

Docker Compose

### Version

Cloud

### Relevant Logs

```shell

Environment

No response

[github-actions]

👋 Hi @tashage, thanks for opening your first issue on AnythingMCP!

A maintainer will triage this within ~48h. To help us help you faster:

• For "how do I…" questions, Discussions / Q&A usually gets faster answers.
• For feature requests, vote on Which integrations should we build next? so we can prioritise based on demand.
• Bug? Please confirm the version and deployment mode (Docker / Railway / DO / Cloud) if you haven't already.

⭐ If AnythingMCP has been useful to you, a star helps others find it.

[keysersoft]

Fixed and live. Your diagnosis was exactly right, and thank you for writing it down twice.

Etsy wants the API key on every request as keystring:shared_secret, bearer token or not. We sent the keystring alone, so the connector had never worked for anybody: 70 calls, 70 failures, across every workspace that had installed it. Not your credentials, not your setup.

What went out:

• x-api-key is now ${ETSY_CLIENT_ID}:${ETSY_CLIENT_SECRET}, verified against Etsy with a real key. Keystring alone gets 403 "Shared secret is required in x-api-key header", the pair gets 200.
• The healthcheck was testing / which is a 404 on the Etsy API, so Test connection failed on a connector that was otherwise fine. It now pings /v3/application/openapi-ping, which needs only the API key, so a green test means Etsy really accepted it.
• The connector page documented the wrong header, which is what sent you looking. It now documents the right one and quotes that 403 so the next person can search for it. It also says that "No authorization URL configured" is expected on a refresh-token connector rather than a fault, which was your third observation.
• Every already-installed Etsy connector was repaired in place, so nobody has to re-enter credentials or redo OAuth.

Shipped as #637, with a note about the token cache wording in #639. A test now pins the header, because the old one asserted the broken value, which is why this survived so long.

Closing this. If anything Etsy-shaped still misbehaves, open another one and I will look at it directly.