Credential storage
When you create an API key we take your Poshmark username and password and encrypt the password with AES-256-GCM before it touches a disk, using random IVs and authentication tags so every ciphertext is unique and tamper-evident.
Your password is never written to application logs, never included in error reports, and never displayed back to you or to us in plaintext.
What we access
We sign in as you to read the data you already own: your order history, your earnings, and your listings. That data is stored against your account so the API can answer queries without hitting Poshmark on every request.
What we never do
Deleting your data
Revoke your key and we destroy the stored credential and purge your synced history. Email privacy@poshmarkapi.com if you'd rather we do it for you.
Still have a question?
The FAQ covers the ones we get most.