Marketplace ban risk in 2026: official APIs, DOM injection, and which tools get you banned

Three ways a tool touches a marketplace, and only one of them is a good idea

Every seller tool connects to Vinted, Depop or eBay in exactly one of three ways. That choice decides your ban risk far more than the brand name, the price, or how many Trustpilot stars the vendor bought.

1. Official API: the boring, correct answer

The platform publishes an interface, authorised software talks through it, and the platform knows exactly who you are and how often you are doing it. Misbehaviour gets you rate-limited instead of deleted. Safest by a distance, and also the scarcest in 2026, because the ground just moved.

Depop built a Selling API. Inventory, orders, webhooks, offers, a sandbox to break things in. It is not public, though, and Depop's own docs are refreshingly blunt about it: the API "is currently private and is not available to the general public", and API keys and OAuth credentials "can't be configured by you directly, instead you will need to contact us first". The OAuth path is described as being for "third-party applications (such as cross-listing tools) that will be used by multiple sellers". Read that as Depop converting cross-listing from grey zone to approved-partner list. Vendoo rebuilt its whole Depop integration on that API in July 2026 and now runs listing, delisting, importing, syncing, sale detection, sharing and offers through it with no browser extension involved. Depop did not get softer. It got a guest list.

Vinted built one too, then locked the door. Vinted Pro Integrations covers item management, webhooks and orders, and Vinted's own documentation says it "is available only to a limited set of allowlisted Vinted Pro businesses". Vinted Pro is not open to US sellers. Authorised integrations are reported to be capped around 500 active listings. So for a normal seller there is no sanctioned door at all: the terms demand authorisation for external tools, nobody issues it, and everyone quietly uses the fire exit. If a tool advertises an "official Vinted integration", ask for the authorisation. There is no list. There is no form. There is no integration.

2. DOM injection: what you are probably already using

A Chrome extension drives the real website, opening the listing form and filling it in like a human, at human speed or faster. No forged tokens. The session is legitimately yours. Most crosslisters work this way, and most of our directory's extension-based tools do too.

The risk here is the most misunderstood thing in the entire market, because DOM injection is not a category, it is a dial. The same technique runs from indistinguishable-from-human to screaming-machine, and the only variables are pacing, volume and how much the account has to lose.

One listing every 45-60 seconds, spaced actions, varied photos, an account with history: reads as a fast human, works indefinitely.

A hundred listings in an afternoon, identical images across four marketplaces, an account opened last Tuesday: reads as a script with a cookie, gets a captcha wall, a disabled listing button, and a support thread that goes nowhere.

Careful vendors publish their throttling, because on Vinted the throttle is the product. One major crosslister documents a 45-second-per-listing pace on Vinted specifically to stay under rate limits and says its queue exists to safeguard accounts. Another documents a soft cap of 400 items a day and warns that speed trips bot protection and drops the session. So when a competitor advertises 200 listings in five minutes, understand what is being sold: not speed, exposure. That tool is not thirty times better than the slow one. It is the reason accounts get actioned, and it takes your whole workflow down with it.

3. Private API reversing: the one that gets you banned

The tool impersonates the mobile app or an internal web API. Real-looking requests, reverse-engineered endpoints, session tokens rotated to look organic. This is what every "Vinted bot" and "Depop bot" on the market actually is, and it is the most dangerous method by an order of magnitude.

The platform owns the endpoints and rotates them whenever it feels like it, so every rotation is an unannounced outage. Requests come from datacenter IPs, which platforms classify on sight. And detection does not politely stop at the request: Depop sellers describe account actions reaching unrelated accounts and speculate about device fingerprinting. Whether or not the fingerprinting theory is right, the blast radius is not limited to the session you thought you were protecting.

What actually gets accounts actioned, ranked by how clearly the platforms wrote it down

Automated engagement. Auto-follow, auto-unfollow, auto-like, automated favourites, bulk DMs. Depop's terms prohibit "any bots or other third party software". Vinted's October 2026 terms prohibit external software and specifically name automated favouriting and unsolicited bulk messaging. This is the least defensible activity in the market, and it is what most products labelled "bot" are actually selling. The naming is not an accident. "Bot" sells. "Automated favouriting" does not.

Delete-and-relist loops. Banned by name in Vinted's terms: "deleting and re-adding the same Item several times". An entire generation of Vinted visibility tools was built on this loop, and their customers are now paying to violate a clause that names their activity verbatim.

Listing velocity bursts. Volume plus speed is the exact signature rate-limiting exists to catch. Vinted has been issuing 24-hour listing freezes since July 2026 to accounts suspected of automated reposting. A 24-hour freeze is what this enforcement looks like in practice, and that tells you something about the platform's confidence in its own detection.

Cross-platform image fingerprints. The same photo, from the same machine, to four marketplaces. Easiest pattern in the book to spot. Sellers report image reuse as a trigger, vendors list stock images as a top captcha cause, and the fix is free: crop it, reorder it, change the first frame.

Session hygiene. One account logged in from three machines, or a tool running from a datacenter IP. Both produce captchas and flags with no help from anyone. Sellers report challenges appearing for reasons "not fully explained by Vinted", which is platform-speak for nobody knows, including them.

Account age. A brand-new account publishing through a third-party session gets flagged much faster than an established shop doing exactly the same thing. This is the single most consistent pattern in first-hand ban reports: new account plus crosslister equals ban within days, while old accounts crosslist for months without a scratch. Warm the account up. Sell like a normal person first. It is the cheapest insurance available and it costs nothing but patience.

The part where we admit the thing vendors will not

Two things are true at once. Anyone telling you only one of them is selling something.

On paper, the automation most sellers want is not permitted. Vinted requires authorisation for external software tools and has issued it to nobody. Depop allows cross-listing platforms and prohibits bots. No tool can promise you zero risk, because no tool controls the platform's enforcement. Anyone who guarantees your account is safe is guaranteeing a decision Vinted has not made yet.

In practice, enforcement is imperfect, and that cuts both ways. Sellers with no tools have received automation notices. Sellers with extensions have never been touched. A 24-hour time-out is itself the tell: detection is guessing, and sometimes guessing wrong.

So the goal is not "undetectable", a word that exists only in marketing copy. The goal is indistinguishable from a careful human at the level the platform actually measures: pacing, volume, variety, and a real account behind it.

How to read a tool's risk before you hand it your account

Six questions. They map onto the `implementation_type` and `compliance_method` fields in our directory, so you can check the same things we do.

What method does it use? Official API beats DOM injection beats private API reversing. If the vendor will not say, assume the worst, because the worst is what silence usually hides.

Does it throttle or race? Look for published intervals, daily caps, and queue behaviour. Throttling is a feature. If it is not in writing, it is not in the code.

Does it act on its own or wait for you? Alerts and one-tap actions sit near human behaviour. Zero-click automation that buys, publishes or messages without you does not.

What happens when the platform pushes back? Captchas, rate limits and session drops should surface as a pause with a clear next step. Silent retries are how you discover problems via email.

Does it touch engagement, or only inventory? Cross-listing moves your catalogue. Auto-following and bulk messaging move the platform's own dynamics. The second category is where accounts die, and no amount of good listings will save you.

What does it need from your account? A cloud integration with the platform's blessing and an extension using your own session are very different propositions from handing credentials to a datacenter service that may not exist next quarter.

Rules that hold no matter which tool you pick

Keep automated and manual actions in the same rhythm. If you would not do 200 of an action by hand in an hour, do not let a tool do it, because the platform is looking at the shape of the activity, not your intentions.

Warm the account before you connect anything.

Vary images and copy between marketplaces. Deliberately.

Refund fast when you oversell. On Depop it is a written obligation, and honouring it is the difference between a support ticket and an enforcement action.

Keep a second channel. The sellers who survive each tightening are the ones whose income does not depend on one platform's algorithm. Notice that every vendor quoted in this piece recommends the same thing, including the ones with something to lose by saying it.

When you get a notice, slow down instead of appealing loudly. Read what it actually alleges. Keep your own record of what you published and when, because the platform's record and yours will eventually disagree and yours is the one you can produce.

Bottom line

Ban risk in 2026 is not about the label on the bottle. It comes down to three variables, and none of them is the vendor's logo.

Connection method. Low risk is a sanctioned API or a legitimate session with human pacing. High risk is an impersonated app API running from a datacenter IP.

Volume and pacing. Low risk is spaced, capped, queue-driven. High risk is bursts, no cap, no queue.

What is automated. Low risk is inventory movement: listing, delisting, syncing. High risk is engagement: follows, likes, bulk messages.

Choose a tool that automates the boring inventory work through a real session at a speed a human could plausibly sustain, and leave the engagement buttons alone. The platforms are not measuring how clever your software is. They are measuring whether you look like a person doing admin. Which, if you think about it, is all cross-listing ever was.